Read the docs
TI-2026-29239 Aliases CVE-2026-40488GHSA-3j5q-7q7h-2hhv

OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution

Priority HIGH 73CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00691 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed magento-lts (OpenMage): 20.17.0openmage/magento-lts (Packagist): 20.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 20.17.020.17.0Patch availableCNA
—openmage/magento-lts (Packagist)before 20.17.020.17.0Patch availableGHSA-3j5q-7q7h-2hhv
  • magento-lts VendorOpenMage Affected before 20.17.0 Fixed in 20.17.0 Patch available CNA
  • openmage/magento-lts (Packagist) Vendor— Affected before 20.17.0 Fixed in 20.17.0 Patch available GHSA-3j5q-7q7h-2hhv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*before 20.17.0VulnerableOpenMage
  • cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* Versions before 20.17.0 Vulnerable ·OpenMage

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 20.17.0
  • Fix · GHSA-3j5q-7q7h-2hhv openmage/magento-lts (Packagist) Fixed in 20.17.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40488
  2. 2026-10-03 Alias added: GHSA-3j5q-7q7h-2hhv

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
  • TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3
  • TI-2026-20634 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module CVSS 3.1MEDIUM 4.9
  • TI-2025-39617 OpenMage is vulnerable to XSS in Admin Notifications CVSS 4.0MEDIUM 4.6
  • TI-2021-04494 Magneto-lts vulnerable to Cross-Site Request Forgery CVSS 3.1MEDIUM 4.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences