TI-2021-18070 Aliases CVE-2021-41231 GHSA-h632-p764-pjqm

OpenMage LTS DataFlow upload remote code execution vulnerability

LOW 36CWE-77Published 2023-01-27 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01286 70th percentileScored 2026-11-07

Fix Fixed magento-lts (OpenMage): 19.4.22, 20.0.19openmage/magento-lts (Packagist): 19.4.22, 20.0.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenMage	magento-lts	before 19.4.22; 20.0.0 to before 20.0.19	19.4.22, 20.0.19	Patch available	CNA
—	openmage/magento-lts (Packagist)	before 19.4.22	19.4.22	Patch available	GHSA-h632-p764-pjqm
—	openmage/magento-lts (Packagist)	20.0.0 to before 20.0.19	20.0.19	Patch available	GHSA-h632-p764-pjqm

magento-lts VendorOpenMage Affected before 19.4.22; 20.0.0 to before 20.0.19 Fixed in 19.4.22, 20.0.19 Patch available CNA
openmage/magento-lts (Packagist) Vendor— Affected before 19.4.22 Fixed in 19.4.22 Patch available GHSA-h632-p764-pjqm
openmage/magento-lts (Packagist) Vendor— Affected 20.0.0 to before 20.0.19 Fixed in 20.0.19 Patch available GHSA-h632-p764-pjqm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openmage:magento:::::lts:::*	before 19.4.22; 20.0.0 to before 20.0.19	Vulnerable	OpenMage

cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* Versions before 19.4.22; 20.0.0 to before 20.0.19 Vulnerable ·OpenMage

Remediation

Fix · CNA magento-lts (OpenMage) Fixed in 19.4.22, 20.0.19
Fix · GHSA-h632-p764-pjqm openmage/magento-lts (Packagist) Fixed in 19.4.22 Advisory →
Fix · GHSA-h632-p764-pjqm openmage/magento-lts (Packagist) Fixed in 20.0.19 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41231
2026-10-03 Alias added: GHSA-h632-p764-pjqm

References

Patch 1

https://github.com/OpenMage/magento-lts/commit/d16fc6c5a1e66c6f0d9f82020f11702a7ddd78e4

Advisory 4

Other 1

https://github.com/OpenMage/magento-lts

TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
TI-2026-29239 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVSS 4.0HIGH 8.7
TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3
TI-2026-20634 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module CVSS 3.1MEDIUM 4.9
TI-2025-39617 OpenMage is vulnerable to XSS in Admin Notifications CVSS 4.0MEDIUM 4.6

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences