{"id":"CVE-2026-128046","kind":"vulnerability","aliases":["CVE-2026-128046"],"related":[],"title":"OpenMage magento-lts: unauthenticated file upload lets attackers run PHP code","description":"OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.","summary":"OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 blocks some PHP file extensions for uploads but omits phar, php8 and phps. An unauthenticated attacker can upload a .phar file through a product File custom option and request it directly to run code on the server.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","magento-lts","openmage","package","php","self-hosted"],"not_affected_if":["fixed-version","no-file-custom-options","phar-not-executed"],"how_to_check":"- Check the installed magento-lts version in composer.json or the release tag, and see whether it is below `20.18.2` (20.x line) or below `21.0.0-beta3` (21.0.0-beta line).\n- Look at `general/file/protected_extensions` in the admin configuration to see whether `phar`, `php8` and `phps` are missing from the blocklist.\n- Check whether the web server maps `.phar` to PHP and serves `media/custom_options`.","fix":"- OpenMage magento-lts 20.x: upgrade to `20.18.2`\n- OpenMage magento-lts 21.0.0-beta: upgrade to `21.0.0-beta3`","status":"open","published_at":"2026-11-13T10:18:10+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","triaged_at":"2026-11-13T10:48:29+00:00","updated_at":"2026-11-13T10:48:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:48:29Z","model":"claude-haiku-5-5","output":{"fix":"- OpenMage magento-lts 20.x: upgrade to `20.18.2`\n- OpenMage magento-lts 21.0.0-beta: upgrade to `21.0.0-beta3`","reach":"internet","title":"OpenMage magento-lts: unauthenticated file upload lets attackers run PHP code","impact":"high","summary":"OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 blocks some PHP file extensions for uploads but omits phar, php8 and phps. An unauthenticated attacker can upload a .phar file through a product File custom option and request it directly to run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openmage","magento-lts","php","self-hosted","ecommerce"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attackers run code on the store server","analyst_note":"","how_to_check":"- Check the installed magento-lts version in composer.json or the release tag, and see whether it is below `20.18.2` (20.x line) or below `21.0.0-beta3` (21.0.0-beta line).\n- Look at `general/file/protected_extensions` in the admin configuration to see whether `phar`, `php8` and `phps` are missing from the blocklist.\n- Check whether the web server maps `.phar` to PHP and serves `media/custom_options`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","phar-not-executed","no-file-custom-options"],"who_is_affected":"Stores running OpenMage magento-lts in the affected ranges are exposed when product File custom options accept uploads and the server maps .phar to PHP and serves the media/custom_options directory. Installations that do not run this version range, or that block .phar execution at the web server, are less exposed. The sources do not describe further conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000826,"input_tokens":4711,"output_tokens":710,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-128046':15A,18A '-2026':14A,17A '20.17.0':33B,83C '20.18.2':35B,85C '21.0.0':37B,40B,87C,90C 'attack':9A,57B,108C 'beta1':38B,88C 'beta3':41B,91C 'block':42B 'blocklist':101C 'code':12A,75B,131C 'contain':92C 'custom':67B,118C 'cve':13A,16A 'direct':72B,128C 'directori':142C 'ecommerc':19B 'execut':130C 'extens':46B 'file':6A,45B,62B,66B,95C,113C,117C 'general/file/protected_extensions':100C 'host':28B 'let':8A 'lts':4A,22B,32B,82C 'magento':3A,21B,31B,81C 'magento-lt':2A,20B,30B,80C 'map':135C 'media/custom_options':123C 'omit':50B,102C 'openmag':1A,23B,29B,79C 'option':68B,119C 'packag':24B 'path':124C 'phar':51B,61B,103C,112C,136C 'php':11A,25B,44B,138C 'php8':52B,104C 'phps':54B,106C 'predict':122C 'product':65B,116C 'request':70B,126C 'run':10A,74B 'self':27B 'self-host':26B 'serv':140C 'server':78B,133C 'unauthent':5A,56B,107C 'unrestrict':94C 'upload':7A,48B,59B,96C,110C 'vulner':97C","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage magento-lts in the affected ranges are exposed when product File custom options accept uploads and the server maps .phar to PHP and serves the media/custom_options directory. Installations that do not run this version range, or that block .phar execution at the web server, are less exposed. The sources do not describe further conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","ecommerce","magentolts","openmage","package","php","selfhosted"],"campaign_type":null,"search_a":"'-128046':15A,18A '-2026':14A,17A 'attack':9A 'code':12A 'cve':13A,16A 'file':6A 'let':8A 'lts':4A 'magento':3A 'magento-lt':2A 'openmag':1A 'php':11A 'run':10A 'unauthent':5A 'upload':7A","search_b":"'20.17.0':33B '20.18.2':35B '21.0.0':37B,40B 'attack':57B 'beta1':38B 'beta3':41B 'block':42B 'code':75B 'custom':67B 'direct':72B 'ecommerc':19B 'extens':46B 'file':45B,62B,66B 'host':28B 'lts':22B,32B 'magento':21B,31B 'magento-lt':20B,30B 'omit':50B 'openmag':23B,29B 'option':68B 'packag':24B 'phar':51B,61B 'php':25B,44B 'php8':52B 'phps':54B 'product':65B 'request':70B 'run':74B 'self':27B 'self-host':26B 'server':78B 'unauthent':56B 'upload':48B,59B","search_c":"'20.17.0':83C '20.18.2':85C '21.0.0':87C,90C 'attack':108C 'beta1':88C 'beta3':91C 'blocklist':101C 'code':131C 'contain':92C 'custom':118C 'direct':128C 'directori':142C 'execut':130C 'file':95C,113C,117C 'general/file/protected_extensions':100C 'lts':82C 'magento':81C 'magento-lt':80C 'map':135C 'media/custom_options':123C 'omit':102C 'openmag':79C 'option':119C 'path':124C 'phar':103C,112C,136C 'php':138C 'php8':104C 'phps':106C 'predict':122C 'product':116C 'request':126C 'serv':140C 'server':133C 'unauthent':107C 'unrestrict':94C 'upload':96C,110C 'vulner':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T19:59:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128046","severity":null,"published_at":"2026-11-13T10:18:10+00:00","modified_at":"2026-11-13T10:18:10+00:00","first_seen_at":"2026-11-13T10:47:32+00:00","fetched_at":"2026-11-13T10:47:32+00:00","note":null}],"documents":[{"id":145357,"url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145400,"url":"https://github.com/OpenMage/magento-lts/commit/ba76b2346fe1e380f39c23e68ccb818d7324d24f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145358,"url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145402,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-4fxg-469f-r6fc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T19:59:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145403,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-20.17.0-before-20.18.2-unrestricted-file-upload-rce-via-custom-options","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}