CVE-2026-128046 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 blocks some PHP file extensions for uploads but omits phar, php8 and phps. An unauthenticated attacker can upload a .phar file through a product File custom option and request it directly to run code on the server.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts in the affected ranges are exposed when product File custom options accept uploads and the server maps .phar to PHP and serves the media/custom_options directory. Installations that do not run this version range, or that block .phar execution at the web server, are less exposed. The sources do not describe further conditions.
Not affected if fixed-version, no-file-custom-options, phar-not-executed
Who cares ecommerce, magento-lts, openmage, php, self-hosted
20.18.2 (20.x line) or below 21.0.0-beta3 (21.0.0-beta line).general/file/protected_extensions in the admin configuration to see whether phar, php8 and phps are missing from the blocklist..phar to PHP and serves media/custom_options.OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
20.18.221.0.0-beta3This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.