Read the docs
TI-2026-30528 Aliases CVE-2026-42207GHSA-qpgq-5g92-j5q8

Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts

Priority MEDIUM 60CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed magento-lts (OpenMage): 20.18.0openmage/magento-lts (Packagist): 20.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 20.18.020.18.0Patch availableCNA
—openmage/magento-lts (Packagist)before 20.18.020.18.0Patch availableGHSA-qpgq-5g92-j5q8
  • magento-lts VendorOpenMage Affected before 20.18.0 Fixed in 20.18.0 Patch available CNA
  • openmage/magento-lts (Packagist) Vendor— Affected before 20.18.0 Fixed in 20.18.0 Patch available GHSA-qpgq-5g92-j5q8

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 20.18.0
  • Fix · GHSA-qpgq-5g92-j5q8 openmage/magento-lts (Packagist) Fixed in 20.18.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42207
  2. 2026-10-03 Alias added: GHSA-qpgq-5g92-j5q8

References

Advisory 1

Other 2

  • TI-2026-30484 Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs CVSS 4.0CRITICAL 9.3
  • TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2026-29239 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
  • TI-2026-30747 Magento LTS: Reflected XSS - Import -> Data Flow (profiles) CVSS 4.0MEDIUM 5.3
  • TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences