Skip to main content

OpenMage Magento LTS EUVDEUVD-2026-30575

| CVE-2026-42458 MEDIUM
Improper Neutralization of Alternate XSS Syntax (CWE-87)
2026-05-06 https://github.com/OpenMage/magento-lts GHSA-x8jv-q8j2-487c
XSS PHP
5.3
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
CVSS changed
May 15, 2026 - 17:22 NVD
5.3 (MEDIUM)
Source Code Evidence Fetched
May 06, 2026 - 21:32 vuln.today
Analysis Generated
May 06, 2026 - 21:32 vuln.today
CVE Published
May 06, 2026 - 20:57 nvd
MEDIUM

DescriptionGitHub Advisory

A reflected XSS vulnerability was found under admin panel -> System -> Import/Export -> Dataflow - Profiles.

Steps to produce

+ Login to the admin panel

+ Go to the path System -> Import/Export -> Dataflow - Profiles

+ Select profile direction as Import.

+ Click on Import Customers

+ Upload the file.

File Link: customer_20260212_204335.csv

+ Go back to Run profile.

+ Select the uploaded file and Click on Run in Popup.

+ One can see a URL like this

https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/import-20260215151125-1_customer_20260212_204335.csv/

+ One can see the filename getting reflection in HTML tags.

+ Inject an HTML tag and observe.

https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/"><h3>hacked</h3>/

<img width="1796" height="302" alt="image (3)" src="https://github.com/user-attachments/assets/502330b0-fa73-4b90-a81f-6216a98e474a" />

+ One can see the tag is getting executed.

+ Proceed for XSS.

https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/%3CScRiPt%20%3Eprompt(document.cookie)%3C%2FScRiPt%3E

<img width="1670" height="562" alt="image (4)" src="https://github.com/user-attachments/assets/98a75081-fa8c-4483-9078-0ab5e7e14e4d" />

+ There is an XSS popup.

Impact

Cookie stealing, JS deface, many more

AnalysisAI

Reflected cross-site scripting (XSS) in OpenMage Magento LTS versions up to 20.17.0 allows authenticated admin users to inject arbitrary JavaScript via the Import/Export Dataflow Profiles run interface. The vulnerability exists in the System → Import/Export → Dataflow Profiles page where unsanitized filename parameters are reflected into HTML context, enabling cookie theft and admin panel defacement. The exploitation requires admin panel access and user interaction to click a malicious link, but no network-based unauthenticated exploitation is possible.

Technical ContextAI

The vulnerability is rooted in improper output encoding in the data flow profile execution interface. The affected code path is /admin/system_convert_gui/run, which accepts a 'files' parameter containing the uploaded filename. This parameter is reflected directly into the HTTP response without HTML entity encoding or Content Security Policy protection, allowing attackers to break out of its intended context and inject arbitrary HTML and JavaScript tags. The CWE-87 classification (improper neutralization of alternate XSS syntax) indicates that the application fails to recognize and block various XSS encoding techniques (URL encoding, mixed case tags, etc.), making filter-bypass trivial. The vulnerability manifests in OpenMage Magento LTS, which is a long-term support fork of the open-source Magento platform (CPE: pkg:composer/openmage_magento-lts), where the system_convert_gui admin controller does not properly escape user-controlled input before rendering it in HTML.

RemediationAI

Upgrade OpenMage Magento LTS to version 20.18.0 or later, which includes proper output encoding for filename parameters in the data flow profile execution interface. The patch can be obtained from the OpenMage GitHub repository at https://github.com/OpenMage/magento-lts. If immediate upgrade is not possible, implement the following compensating controls: (1) restrict admin panel access to a whitelist of trusted IP addresses using web server configuration or a WAF, which prevents unauthorized access vectors but does not prevent social engineering against legitimate admins; (2) implement a Content Security Policy (CSP) header with script-src 'self' to block inline script execution, though this may require testing to ensure admin panel functionality is not impaired; (3) enforce mandatory re-authentication for critical operations in the data flow profile execution page to reduce the window of vulnerability from compromised sessions. Additionally, audit admin account activity and review historical data flow profile runs in logs for signs of injected payloads. Patch deployment to 20.18.0 is the recommended primary mitigation.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-87 – Improper Neutralization of Alternate XSS Syntax

View all
CVE-2023-35161 MEDIUM POC
6.1
CVE-2023-35160 MEDIUM POC
6.1
CVE-2023-35159 MEDIUM POC
6.1
CVE-2023-35158 MEDIUM POC
6.1
CVE-2023-35156 MEDIUM POC
6.1
CVE-2026-42235 HIGH
8.8
CVE-2026-33506 HIGH
8.8
CVE-2026-33510 HIGH
8.8

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

EUVD-2026-30575 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy