MAGENTO-LTS · CVE-2026-128028 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts accepts SVG, XHTML or XML files as guest uploads on product File custom options when the allowed-extension list is empty. An attacker can get a victim to open the uploaded file URL, running script in the store's origin and potentially exposing administrator sessions if the admin panel shares that origin.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts with product File custom options enabled and an empty allowed-extension list. Exposure is worse when the admin panel is served from the same origin as the storefront. Stores on the fixed versions, or without File custom options, can skip it.
Not affected if admin-separate-origin, no-file-custom-options, patched-version
Who cares magento, openmage, php, self-hosted
20.18.2 on the 20.x line and before 21.0.0-beta3 on the 21.0.0-beta line.20.18.2 for the 20.x line, 21.0.0-beta3 for the 21.0.0-beta lineOpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.