Is there a patch available for CVE-2026-42458?

Yes, a patch is available for CVE-2026-42458. Update the affected software to the latest version immediately.

OpenMage Magento LTS CVE-2026-42458

Q: What is the CVSS score of CVE-2026-42458?

CVE-2026-42458 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30575 MEDIUM

Improper Neutralization of Alternate XSS Syntax (CWE-87)

2026-05-06 https://github.com/OpenMage/magento-lts

GHSA-x8jv-q8j2-487c

XSS PHP

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 15, 2026 - 17:22 NVD

5.3 (MEDIUM)

Source Code Evidence Fetched

May 06, 2026 - 21:32 vuln.today

Analysis Generated

May 06, 2026 - 21:32 vuln.today

CVE Published

May 06, 2026 - 20:57 nvd

MEDIUM

DescriptionGitHub Advisory

A reflected XSS vulnerability was found under admin panel -> System -> Import/Export -> Dataflow - Profiles.

Steps to produce

+ Login to the admin panel

+ Go to the path System -> Import/Export -> Dataflow - Profiles

+ Select profile direction as Import.

+ Click on Import Customers

+ Upload the file.

File Link: customer_20260212_204335.csv

+ Go back to Run profile.

+ Select the uploaded file and Click on Run in Popup.

+ One can see a URL like this

https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/import-20260215151125-1_customer_20260212_204335.csv/

+ One can see the filename getting reflection in HTML tags.

+ Inject an HTML tag and observe.

https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/"><h3>hacked</h3>/

+ One can see the tag is getting executed.

+ Proceed for XSS.

https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/%3CScRiPt%20%3Eprompt(document.cookie)%3C%2FScRiPt%3E

+ There is an XSS popup.

Impact

Cookie stealing, JS deface, many more

AnalysisAI

Reflected cross-site scripting (XSS) in OpenMage Magento LTS versions up to 20.17.0 allows authenticated admin users to inject arbitrary JavaScript via the Import/Export Dataflow Profiles run interface. The vulnerability exists in the System → Import/Export → Dataflow Profiles page where unsanitized filename parameters are reflected into HTML context, enabling cookie theft and admin panel defacement. The exploitation requires admin panel access and user interaction to click a malicious link, but no network-based unauthenticated exploitation is possible.

Technical ContextAI

The vulnerability is rooted in improper output encoding in the data flow profile execution interface. The affected code path is /admin/system_convert_gui/run, which accepts a 'files' parameter containing the uploaded filename. This parameter is reflected directly into the HTTP response without HTML entity encoding or Content Security Policy protection, allowing attackers to break out of its intended context and inject arbitrary HTML and JavaScript tags. The CWE-87 classification (improper neutralization of alternate XSS syntax) indicates that the application fails to recognize and block various XSS encoding techniques (URL encoding, mixed case tags, etc.), making filter-bypass trivial. The vulnerability manifests in OpenMage Magento LTS, which is a long-term support fork of the open-source Magento platform (CPE: pkg:composer/openmage_magento-lts), where the system_convert_gui admin controller does not properly escape user-controlled input before rendering it in HTML.

RemediationAI

Upgrade OpenMage Magento LTS to version 20.18.0 or later, which includes proper output encoding for filename parameters in the data flow profile execution interface. The patch can be obtained from the OpenMage GitHub repository at https://github.com/OpenMage/magento-lts. If immediate upgrade is not possible, implement the following compensating controls: (1) restrict admin panel access to a whitelist of trusted IP addresses using web server configuration or a WAF, which prevents unauthorized access vectors but does not prevent social engineering against legitimate admins; (2) implement a Content Security Policy (CSP) header with script-src 'self' to block inline script execution, though this may require testing to ensure admin panel functionality is not impaired; (3) enforce mandatory re-authentication for critical operations in the data flow profile execution page to reduce the window of vulnerability from compromised sessions. Additionally, audit admin account activity and review historical data flow profile runs in logs for signs of injected payloads. Patch deployment to 20.18.0 is the recommended primary mitigation.