Security Advisories - openmage/magento-lts

openmage/magento-lts Security Advisories (23)

[HIGH] OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

PKSA-ctbx-q2cr-ntvc CVE-2026-40488 GHSA-3j5q-7q7h-2hhv

Affected version: <=20.16.0

Reported by:
GitHub
[MEDIUM] OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure

PKSA-sg96-p97c-1769 CVE-2026-40098 GHSA-665x-ppc4-685w

Affected version: <20.17.0

Reported by:
GitHub
[MEDIUM] OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module

PKSA-t8bb-kchx-xyxb CVE-2026-25525 GHSA-6vqf-6fhm-7rc6

Affected version: <20.17.0

Reported by:
GitHub
[HIGH] OpenMage LTS: Phar Deserialization leads to Remote Code Execution

PKSA-w28m-jx16-bpbn CVE-2026-25524 GHSA-fg79-cr9c-7369

Affected version: <20.17.0

Reported by:
GitHub
[MEDIUM] Magento's X-Original-Url header can expose admin url

PKSA-nz6n-ckcm-yb2x CVE-2026-25523 GHSA-jg68-vhv3-9r8f

Affected version: <20.16.1

Reported by:
GitHub
[MEDIUM] OpenMage vulnerable to XSS in Admin Notifications

PKSA-t425-mpgn-4yhs CVE-2025-64174 GHSA-qv78-c8hc-438r

Affected version: <20.16.0

Reported by:
GitHub
[LOW] Magento LTS vulnerable to stored XSS in theme config fields

PKSA-626k-1yg1-m164 CVE-2025-27400 GHSA-5pxh-89cx-4668

Affected version: <20.12.3

Reported by:
GitHub
[MEDIUM] Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

PKSA-w1pc-fvwg-8vsf CVE-2024-41676 GHSA-5vrp-638w-p8m2

Affected version: <20.10.1

Reported by:
GitHub
[MEDIUM] Magento LTS vulnerable to stored XSS in admin file form

PKSA-7kjg-jm3v-dfw2 GHSA-gp6m-fq6h-cjcx

Affected version: <19.5.3|>=20.0.0,<20.5.0

Reported by:
GitHub
[HIGH] Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

PKSA-gyfx-x49w-8nbg GHSA-9j5w-2cqc-cwj9

Affected version: <20.2.0

Reported by:
GitHub
[HIGH] Magento LTS's guest order "protect code" can be brute-forced too easily

PKSA-w6px-tkth-7g4y CVE-2023-41879 GHSA-9358-cpvx-c2qp

Affected version: >=20.0.0,<=20.1.0|<=19.5.0

Reported by:
GitHub
[HIGH] DataFlow upload remote code execution vulnerability

PKSA-14st-8g6h-6qyt CVE-2021-41231 GHSA-h632-p764-pjqm

Affected version: >=20.0.0,<20.0.19|<19.4.22

Reported by:
GitHub
[HIGH] Fix for authenticated remote code execution through layout update

PKSA-17zx-zwgr-c4fs CVE-2021-41144 GHSA-5j2g-3ph4-rgvm

Affected version: >=20.0.0,<20.0.19|<19.4.22

Reported by:
GitHub
[MEDIUM] DoS vulnerability in MaliciousCode filter

PKSA-d7zw-pyw4-4byv CVE-2023-23617 GHSA-3p73-mm7v-4f6m

Affected version: >=20.0.0,<20.0.19|<19.4.22

Reported by:
GitHub
[HIGH] Fix for arbitrary file deletion in customer media allows for remote code execution

PKSA-69r2-jwnk-px22 CVE-2021-41143 GHSA-5vpv-xmcj-9q85

Affected version: >=20.0.0,<20.0.19|<19.4.22

Reported by:
GitHub
[HIGH] Fix for arbitrary command execution in custom layout update through blocks

PKSA-mt33-5d4f-b3f9 CVE-2021-39217 GHSA-c9q3-r4rv-mjm7

Affected version: >=20.0.0,<20.0.19|<19.4.22

Reported by:
GitHub
[MEDIUM] magento-lts Reset Password not protected against well-timed CSRF

PKSA-dgzr-rbc9-1c35 CVE-2021-21395 GHSA-r3c9-9j5q-pwv4

Affected version: >=20.0.0,<20.0.19|<19.4.22

Reported by:
GitHub
[HIGH] Layout XML Arbitrary Code Fix

PKSA-6tp2-18nz-68zw CVE-2021-32758 GHSA-26rr-v2j2-25fh

Affected version: >=20.0.0,<20.0.13|<19.4.15

Reported by:
GitHub
[HIGH] Data Flow Sanitation Issue Fix

PKSA-2gfb-xsvf-8zbw CVE-2021-32759 GHSA-xm9f-vxmx-4m58

Affected version: >=20.0.0,<20.0.13|<19.4.15

Reported by:
GitHub
[CRITICAL] Backport for CVE-2021-21024 Blind SQLi from Magento 2

PKSA-xyp3-9qyk-2bz5 CVE-2021-21427 GHSA-fvrf-9428-527m

Affected version: >=20.0.0,<=20.0.8|<=19.4.12

Reported by:
GitHub
[CRITICAL] Fixes a bug in Zend Framework's Stream HTTP Wrapper

PKSA-spdm-wpcb-rct9 CVE-2021-21426 GHSA-m496-x567-f98c

Affected version: >=20.0.0,<=20.0.8|<=19.4.12

Reported by:
GitHub
[HIGH] RCE via PHP Object injection via SOAP Requests

PKSA-7t2t-th5q-9yb9 CVE-2020-15244 GHSA-jrgf-vfw2-hj26

Affected version: >=20.0.0,<20.0.4|<19.4.8

Reported by:
GitHub
[HIGH] Observable Timing Discrepancy in OpenMage LTS

PKSA-47kr-9ktz-j2fd CVE-2020-15151 GHSA-crf2-xm6x-46p6

Affected version: >=20.0.0,<20.0.2|<19.4.6

Reported by:
GitHub

openmage/magento-lts Security Advisories (23)

[HIGH] OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

[MEDIUM] OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure

[MEDIUM] OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module

[HIGH] OpenMage LTS: Phar Deserialization leads to Remote Code Execution

[MEDIUM] Magento's X-Original-Url header can expose admin url

[MEDIUM] OpenMage vulnerable to XSS in Admin Notifications

[LOW] Magento LTS vulnerable to stored XSS in theme config fields

[MEDIUM] Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

[MEDIUM] Magento LTS vulnerable to stored XSS in admin file form

[HIGH] Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

[HIGH] Magento LTS's guest order "protect code" can be brute-forced too easily

[HIGH] DataFlow upload remote code execution vulnerability

[HIGH] Fix for authenticated remote code execution through layout update

[MEDIUM] DoS vulnerability in MaliciousCode filter

[HIGH] Fix for arbitrary file deletion in customer media allows for remote code execution

[HIGH] Fix for arbitrary command execution in custom layout update through blocks

[MEDIUM] magento-lts Reset Password not protected against well-timed CSRF

[HIGH] Layout XML Arbitrary Code Fix

[HIGH] Data Flow Sanitation Issue Fix

[CRITICAL] Backport for CVE-2021-21024 Blind SQLi from Magento 2

[CRITICAL] Fixes a bug in Zend Framework's Stream HTTP Wrapper

[HIGH] RCE via PHP Object injection via SOAP Requests

[HIGH] Observable Timing Discrepancy in OpenMage LTS