{"id":"CVE-2026-128028","kind":"vulnerability","aliases":["CVE-2026-128028"],"related":[],"title":"OpenMage magento-lts: stored XSS via guest SVG and XML product uploads","description":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.","summary":"OpenMage magento-lts accepts SVG, XHTML or XML files as guest uploads on product File custom options when the allowed-extension list is empty. An attacker can get a victim to open the uploaded file URL, running script in the store's origin and potentially exposing administrator sessions if the admin panel shares that origin.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"magento-lts","fixed":[],"affected":"","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["magento","openmage","package","php","self-hosted"],"not_affected_if":["admin-separate-origin","no-file-custom-options","patched-version"],"how_to_check":"- Check the installed magento-lts version in composer.json or composer.lock; affected before `20.18.2` on the 20.x line and before `21.0.0-beta3` on the 21.0.0-beta line.\n- Look at product File custom option settings for an empty allowed-extension list.\n- Check whether the admin panel shares an origin with the storefront.","fix":"- magento-lts: `20.18.2` for the 20.x line, `21.0.0-beta3` for the 21.0.0-beta line","status":"open","published_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:58:46+00:00","updated_at":"2026-11-13T10:58:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:58:46Z","model":"claude-haiku-5-5","output":{"fix":"- magento-lts: `20.18.2` for the 20.x line, `21.0.0-beta3` for the 21.0.0-beta line","reach":"internet","title":"OpenMage magento-lts: stored XSS via guest SVG and XML product uploads","impact":"medium","summary":"OpenMage magento-lts accepts SVG, XHTML or XML files as guest uploads on product File custom options when the allowed-extension list is empty. An attacker can get a victim to open the uploaded file URL, running script in the store's origin and potentially exposing administrator sessions if the admin panel shares that origin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento","openmage","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"script runs in store origin; admin sessions may be exposed","analyst_note":"","how_to_check":"- Check the installed magento-lts version in composer.json or composer.lock; affected before `20.18.2` on the 20.x line and before `21.0.0-beta3` on the 21.0.0-beta line.\n- Look at product File custom option settings for an empty allowed-extension list.\n- Check whether the admin panel shares an origin with the storefront.","plain_action":"","product_name":"magento-lts","needs_analyst":false,"not_affected_if":["patched-version","no-file-custom-options","admin-separate-origin"],"who_is_affected":"Stores running OpenMage magento-lts with product File custom options enabled and an empty allowed-extension list. Exposure is worse when the admin panel is served from the same origin as the storefront. Stores on the fixed versions, or without File custom options, can skip it.","user_interaction":"yes","product_ecosystem":"composer","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000791,"input_tokens":4730,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128028':16A,19A '-2026':15A,18A '20.18.2':92C '21.0.0':94C,97C 'accept':34B,116C 'admin':82B,158C 'administr':78B,154C 'allow':51B,132C 'allowed-extens':50B,131C 'attack':57B,136C 'beta1':95C 'beta3':98C 'catalog':109C 'contain':99C 'cross':103C 'cross-sit':102C 'custom':46B,126C 'cve':14A,17A 'empti':55B,130C 'execut':146C 'expos':77B,153C 'extens':52B,133C 'file':39B,45B,66B,114C,125C,140C 'get':59B 'guest':8A,41B,117C 'host':29B 'list':53B,134C 'lts':4A,22A,33B,90C 'mage':108C 'magento':3A,21A,23B,32B,89C 'magento-lt':2A,31B,88C 'magento-lts':20A 'media/custom_options':143C 'model':110C 'open':63B 'openmag':1A,24B,30B,87C 'option':47B,112C,127C 'origin':74B,86B,151C,162C 'packag':25B 'panel':83B,159C 'php':26B 'potenti':76B 'product':12A,44B,111C,124C 'run':68B 'script':69B,105C,147C 'self':28B 'self-host':27B 'send':138C 'session':79B,155C 'share':84B,160C 'site':104C 'store':5A,72B,101C,150C 'svg':9A,35B,118C 'type':113C 'unauthent':135C 'upload':13A,42B,65B,122C 'url':67B,141C 'via':7A 'victim':61B,145C 'vulner':106C 'xhtml':36B,119C 'xml':11A,38B,121C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage magento-lts with product File custom options enabled and an empty allowed-extension list. Exposure is worse when the admin panel is served from the same origin as the storefront. Stores on the fixed versions, or without File custom options, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["magentolts"],"ptokens":["lts","magento"],"labels":["composer","magento","medium","openmage","package","php","selfhosted"],"campaign_type":null,"search_a":"'-128028':16A,19A '-2026':15A,18A 'cve':14A,17A 'guest':8A 'lts':4A,22A 'magento':3A,21A 'magento-lt':2A 'magento-lts':20A 'openmag':1A 'product':12A 'store':5A 'svg':9A 'upload':13A 'via':7A 'xml':11A 'xss':6A","search_b":"'accept':34B 'admin':82B 'administr':78B 'allow':51B 'allowed-extens':50B 'attack':57B 'custom':46B 'empti':55B 'expos':77B 'extens':52B 'file':39B,45B,66B 'get':59B 'guest':41B 'host':29B 'list':53B 'lts':33B 'magento':23B,32B 'magento-lt':31B 'open':63B 'openmag':24B,30B 'option':47B 'origin':74B,86B 'packag':25B 'panel':83B 'php':26B 'potenti':76B 'product':44B 'run':68B 'script':69B 'self':28B 'self-host':27B 'session':79B 'share':84B 'store':72B 'svg':35B 'upload':42B,65B 'url':67B 'victim':61B 'xhtml':36B 'xml':38B","search_c":"'20.18.2':92C '21.0.0':94C,97C 'accept':116C 'admin':158C 'administr':154C 'allow':132C 'allowed-extens':131C 'attack':136C 'beta1':95C 'beta3':98C 'catalog':109C 'contain':99C 'cross':103C 'cross-sit':102C 'custom':126C 'empti':130C 'execut':146C 'expos':153C 'extens':133C 'file':114C,125C,140C 'guest':117C 'list':134C 'lts':90C 'mage':108C 'magento':89C 'magento-lt':88C 'media/custom_options':143C 'model':110C 'openmag':87C 'option':112C,127C 'origin':151C,162C 'panel':159C 'product':111C,124C 'script':105C,147C 'send':138C 'session':155C 'share':160C 'site':104C 'store':101C,150C 'svg':118C 'type':113C 'unauthent':135C 'upload':122C 'url':141C 'victim':145C 'vulner':106C 'xhtml':119C 'xml':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T20:00:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128028","severity":null,"published_at":"2026-11-13T10:18:08+00:00","modified_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145356,"url":"https://github.com/OpenMage/magento-lts/commit/5896b2a60b10e892cec594391b2612ab53a4ce59","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145357,"url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145358,"url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145359,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-v7mx-rv47-452m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T20:00:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145360,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-custom-option-svg-upload","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}