EUVD-2026-23891
GHSA-6vqf-6fhm-7rc6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (str_replace('../', '', $input)) to prevent path traversal attacks. This filter can be bypassed using patterns like ..././ or ....//, which after the replacement still result in ../. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.
AnalysisAI
OpenMage LTS Dataflow module prior to version 20.17.0 allows authenticated administrators to read arbitrary files via a bypassable path traversal filter that uses simple string replacement (str_replace('../', '', $input)). Attackers can circumvent the blacklist by using nested patterns like ..././ or ....// which resolve to valid ../ sequences after filtering. Remote administrative access is required, but the high confidentiality impact and confirmed patch availability make immediate patching necessary for affected deployments.
Technical ContextAI
The Dataflow module in OpenMage LTS, a community-maintained fork of Magento Community Edition, implements file handling operations that process user-supplied path inputs. The vulnerability stems from improper use of a simple character-level blacklist filter (CWE-22: Improper Limitation of a Pathname to a Restricted Directory, also known as path traversal). The weak filter uses str_replace('../', '', $input) which performs a single pass removal of the ../ string. This approach fails against obfuscated payloads: when an attacker provides ..././, the filter removes only the first ../, leaving ./ in place; when the server then interprets this in a path context, the dot-slash resolves to the current directory, effectively reconstructing ../. Similarly, ....// becomes ../ after one replacement. The affected product is OpenMage/magento-lts across all versions prior to 20.17.0, tracked by CPE cpe:2.3:a:openmage:magento-lts:*:*:*:*:*:*:*:*. This is a classic insufficient input validation flaw compounded by reliance on blacklist over whitelist filtering.
RemediationAI
Upgrade OpenMage LTS to version 20.17.0 or later immediately, as this version includes the security patch. The vendor-released patch replaces the weak blacklist filter with a more robust path validation mechanism (specific implementation details not disclosed in the advisory). If immediate patching is not feasible, restrict administrative access to the Dataflow module via role-based access control, limiting which user accounts hold administrative privileges; note that this does not eliminate the vulnerability but reduces the attack surface. Additionally, implement filesystem access controls to prevent the web server process from reading sensitive files outside the intended application directories-for example, restricting file permissions so that configuration files and private keys are readable only by specific system accounts, not by the web server user. Monitor Dataflow module activity and alert on path traversal patterns (e.g., requests containing ../, ..././, ....//) in logs. These compensating controls have trade-offs: access restrictions may impact legitimate administrative workflows, and filesystem hardening requires careful permission tuning to avoid breaking application functionality. The primary mitigation remains the vendor patch. Reference the security advisory at https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6vqf-6fhm-7rc6 for additional technical details.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today