What is the CVSS score of CVE-2026-25524?

CVE-2026-25524 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25524?

OpenMage Magento LTS versions before 20.17.0 contain a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary code through malicious file uploads.. A patch is available.

How to fix or mitigate CVE-2026-25524?

Within 24 hours: Identify all OpenMage Magento LTS installations and document current versions. Within 7 days: Upgrade all instances to version 20.17.0 or later; if immediate upgrade is not feasible, implement file upload restrictions blocking .phar files and restrict web access to upload directories. Within 30 days: Verify successful patch deployment across all environments and conduct log review for suspicious file upload activity from the past 90 days.

PHP CVE-2026-25524

EUVD-2026-23889 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-04-20 GitHub_M

GHSA-fg79-cr9c-7369

PHP Adobe Deserialization RCE

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 23, 2026 - 17:47 nvd

Patch available

Re-analysis Queued

Apr 20, 2026 - 17:52 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 17:52 vuln.today

Patch available

Apr 20, 2026 - 17:16 EUVD

EUVD ID Assigned

Apr 20, 2026 - 17:15 euvd

EUVD-2026-23889

Analysis Generated

Apr 20, 2026 - 17:15 vuln.today

CVE Published

Apr 20, 2026 - 16:11 nvd

HIGH 8.1

DescriptionGitHub Advisory

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as getimagesize(), file_exists(), and is_readable() can trigger deserialization when processing phar:// stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a phar:// path can achieve arbitrary code execution. Version 20.17.0 patches the issue.

AnalysisAI

Remote code execution in OpenMage Magento LTS versions prior to 20.17.0 allows unauthenticated attackers to execute arbitrary code by uploading malicious phar archives disguised as images and triggering PHP deserialization via phar:// stream wrappers. The attack requires high complexity (AC:H) to exploit successfully. EPSS data not available, but exploitation requires specific conditions around file upload and path manipulation. Vendor patch available in version 20.17.0, confirmed by GitHub security advisory GHSA-fg79-cr9c-7369.

Technical ContextAI

OpenMage Magento LTS is a community-maintained fork of Magento Community Edition for e-commerce platforms. This vulnerability exploits a well-known PHP deserialization attack vector through phar:// stream wrappers. PHP's phar (PHP Archive) extension automatically deserializes metadata when filesystem functions like getimagesize(), file_exists(), or is_readable() are called on phar:// URLs. OpenMage's image validation and media handling routines use these functions with paths that may be attacker-influenced. When a phar file is uploaded (disguised with image extensions like .jpg or .png), and a vulnerable function processes it via a phar:// wrapper, PHP deserializes embedded objects without validation. This triggers CWE-502 (Deserialization of Untrusted Data), allowing attackers to instantiate arbitrary classes and execute magic methods (__destruct, __wakeup), leading to code execution if gadget chains exist in the application. The attack surface exists wherever user-supplied file paths reach these PHP functions without proper stream wrapper filtering.

RemediationAI

Upgrade immediately to OpenMage Magento LTS version 20.17.0 or later, available at https://github.com/OpenMage/magento-lts/releases/tag/v20.17.0. The vendor-confirmed patch (GHSA-fg79-cr9c-7369) addresses phar deserialization by implementing stream wrapper filtering before passing paths to vulnerable PHP functions. If immediate patching is not feasible, implement these compensating controls: (1) Configure PHP to disable the phar extension via php.ini setting 'phar.readonly=1' and restart PHP-FPM/Apache - this prevents phar:// execution but breaks legitimate phar-dependent functionality if present. (2) Deploy Web Application Firewall rules to block HTTP requests containing 'phar://' strings in file path parameters, headers, or upload fields - bypass risk exists if attackers URL-encode or use alternate representations. (3) Restrict file upload functionality to authenticated administrative users only and implement strict file type validation using magic byte verification (not just extension checks) to reject phar archives - determined attackers may craft polyglot files passing validation. (4) Apply filesystem-level access controls preventing web server processes from reading uploaded files outside designated media directories. Note that workarounds significantly degrade defense-in-depth; patching remains the only complete remediation.