EUVD-2026-23904
GHSA-3j5q-7q7h-2hhv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionGitHub Advisory
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (forbidden_extensions = php,exe) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as .phtml, .phar, .php3, .php4, .php5, .php7, and .pht. Files are stored in the publicly accessible media/custom_options/quote/ directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.
AnalysisAI
Remote code execution in OpenMage Magento LTS versions before 20.17.0 allows authenticated attackers to upload executable PHP files through product custom options by bypassing an incomplete file extension blocklist. The vulnerability exists because the upload filter only blocks .php and .exe extensions, permitting alternative PHP-executable extensions like .phtml, .phar, .php3-.php7, and .pht. Uploaded files land in the publicly accessible media/custom_options/quote/ directory, enabling code execution on servers without explicit script execution restrictions. No active exploitation confirmed (not in CISA KEV), but public disclosure via GitHub Security Advisory increases exploitation likelihood. EPSS data not provided.
Technical ContextAI
OpenMage Magento LTS is a community-maintained fork of Magento 1.x Community Edition, continuing support after Adobe's end-of-life. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type) in the product custom options module. This module allows merchants to configure customizable product options, including file uploads from customers. The implementation uses a hardcoded blocklist approach (forbidden_extensions = php,exe) rather than a secure allowlist. PHP web servers commonly recognize multiple file extensions as executable beyond .php, including legacy extensions (.php3, .php4, .php5, .php7), template extensions (.phtml), archive extensions (.phar), and alternative extensions (.pht). When Apache or nginx is configured with handlers for these extensions, uploaded files execute server-side. The affected CPE (cpe:2.3:a:openmage:magento-lts) confirms this targets the OpenMage fork specifically, not Adobe's current Magento 2.x platform despite the 'Adobe' tag.
RemediationAI
Upgrade to OpenMage Magento LTS version 20.17.0 or later, which replaces the incomplete extension blocklist with comprehensive file upload validation per the vendor advisory at https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3j5q-7q7h-2hhv. If immediate patching is impossible, implement compensating controls: (1) Configure web server to deny script execution in media/custom_options/quote/ directory by adding .htaccess rules for Apache (php_flag engine off) or nginx location block (location ~* ^/media/custom_options/quote/ { deny all; }), which prevents execution but breaks legitimate file downloads for customers; (2) Restrict product custom option file upload functionality to trusted admin users only, disabling customer-facing file uploads entirely, which eliminates the feature's business value; (3) Implement Web Application Firewall rules blocking requests to media/custom_options/quote/*.(phtml|phar|php3|php4|php5|php7|pht), though sophisticated attackers may bypass with double extensions or null-byte injection. All workarounds have significant operational trade-offs compared to patching.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today