Which versions of Magento Lts are affected by CVE-2026-40488?

OpenMage Magento LTS versions prior to 20.17.0 contain a remote code execution vulnerability that allows authenticated users to upload malicious PHP files by exploiting an incomplete file extension…. A patch is available.

How to fix or mitigate CVE-2026-40488?

Within 24 hours: inventory all OpenMage Magento LTS deployments and verify current version against 20.17.0. Within 7 days: apply vendor-released patch to upgrade to OpenMage Magento LTS version 20.17.0 or later on all affected instances; validate patch application in non-production environment first. Within 30 days: conduct security audit of user accounts with product upload permissions, review media/custom_options/quote/ directory for suspicious files, and implement Web Application Firewall rules to restrict PHP execution in upload directories.

Magento Lts CVE-2026-40488

Q: What is the CVSS score of CVE-2026-40488?

CVE-2026-40488 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-23904 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-20 GitHub_M

GHSA-3j5q-7q7h-2hhv

RCE Adobe File Upload Magento Lts Openmage

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 23, 2026 - 17:45 nvd

Patch available

Re-analysis Queued

Apr 20, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 17:53 vuln.today

Patch available

Apr 20, 2026 - 17:16 EUVD

EUVD ID Assigned

Apr 20, 2026 - 17:15 euvd

EUVD-2026-23904

Analysis Generated

Apr 20, 2026 - 17:15 vuln.today

CVE Published

Apr 20, 2026 - 16:23 nvd

HIGH 8.7

DescriptionGitHub Advisory

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (forbidden_extensions = php,exe) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as .phtml, .phar, .php3, .php4, .php5, .php7, and .pht. Files are stored in the publicly accessible media/custom_options/quote/ directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.

AnalysisAI

Remote code execution in OpenMage Magento LTS versions before 20.17.0 allows authenticated attackers to upload executable PHP files through product custom options by bypassing an incomplete file extension blocklist. The vulnerability exists because the upload filter only blocks .php and .exe extensions, permitting alternative PHP-executable extensions like .phtml, .phar, .php3-.php7, and .pht. Uploaded files land in the publicly accessible media/custom_options/quote/ directory, enabling code execution on servers without explicit script execution restrictions. No active exploitation confirmed (not in CISA KEV), but public disclosure via GitHub Security Advisory increases exploitation likelihood. EPSS data not provided.

Technical ContextAI

OpenMage Magento LTS is a community-maintained fork of Magento 1.x Community Edition, continuing support after Adobe's end-of-life. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type) in the product custom options module. This module allows merchants to configure customizable product options, including file uploads from customers. The implementation uses a hardcoded blocklist approach (forbidden_extensions = php,exe) rather than a secure allowlist. PHP web servers commonly recognize multiple file extensions as executable beyond .php, including legacy extensions (.php3, .php4, .php5, .php7), template extensions (.phtml), archive extensions (.phar), and alternative extensions (.pht). When Apache or nginx is configured with handlers for these extensions, uploaded files execute server-side. The affected CPE (cpe:2.3:a:openmage:magento-lts) confirms this targets the OpenMage fork specifically, not Adobe's current Magento 2.x platform despite the 'Adobe' tag.

RemediationAI

Upgrade to OpenMage Magento LTS version 20.17.0 or later, which replaces the incomplete extension blocklist with comprehensive file upload validation per the vendor advisory at https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3j5q-7q7h-2hhv. If immediate patching is impossible, implement compensating controls: (1) Configure web server to deny script execution in media/custom_options/quote/ directory by adding .htaccess rules for Apache (php_flag engine off) or nginx location block (location ~* ^/media/custom_options/quote/ { deny all; }), which prevents execution but breaks legitimate file downloads for customers; (2) Restrict product custom option file upload functionality to trusted admin users only, disabling customer-facing file uploads entirely, which eliminates the feature's business value; (3) Implement Web Application Firewall rules blocking requests to media/custom_options/quote/*.(phtml|phar|php3|php4|php5|php7|pht), though sophisticated attackers may bypass with double extensions or null-byte injection. All workarounds have significant operational trade-offs compared to patching.