OpenMage Magento LTS EUVD-2026-30575

The vulnerability requires three specific conditions: (1) authenticated admin panel access-the attacker must be a legitimate admin or trick an admin into clicking a link while authenticated, as the /admin/ path is behind authentication; (2) the data flow profile import feature must be accessible (not disabled by administrator), and the victim must have navigated to System → Import/Export → Dataflow Profiles at least once to generate a valid profile run URL with a security key parameter; (3) the victim's browser must not have strict Content Security Policy enforcement that blocks inline script execution. The vulnerability does not require file upload success or any special server-side configuration-the XSS payload is injected purely through URL manipulation of the 'files' parameter. The presence of the security key in the URL (e.g., 'key/40dbbb2e93f45f0463c57ff733352f4f/') is a CSRF token, but it does not prevent XSS since the vulnerable parameter is in the same request. This is a reflected XSS that activates only when the URL is visited; no payload persistence or server-side storage is required.

This is a moderate-severity vulnerability with important caveats that limit real-world exploitation scope. The CVSS vector is not provided in the input data, preventing formal severity calculation; however, the attack vector is network-accessible but requires both admin panel authentication and victim interaction (clicking a malicious link), which significantly reduces exploitability compared to unauthenticated network attacks. The reflected XSS nature means no persistent payload storage is required-each attack requires a fresh social engineering attempt. The impact is significant for authenticated admins: attackers can steal session cookies, perform unauthorized admin actions, modify product data, or inject malicious content, but only within the admin panel scope (not customer-facing). Exploitation requires two preconditions: (1) victim must be authenticated as admin and (2) victim must click or be redirected to a crafted URL. No public exploit code or CISA KEV listing is indicated in the provided data, suggesting limited real-world weaponization at the time of disclosure. Organizations running older Magento LTS instances (20.17.0 and below) in publicly accessible environments face elevated risk if admins visit untrusted links while logged in. The straightforward proof-of-concept steps provided indicate low technical barrier to exploitation for those with admin access.

An attacker crafts a malicious URL containing JavaScript code (e.g., a cookie-stealing payload) in the 'files' parameter of the /admin/system_convert_gui/run endpoint and sends it to a known Magento admin user via phishing email or compromised website. When the authenticated admin clicks the link while logged into the Magento admin panel, the injected JavaScript executes in their browser with full admin session context, allowing the attacker to steal the session cookie, extract sensitive data, or perform unauthorized admin actions such as disabling two-factor authentication or creating a backdoor admin account.