Unrestricted File Upload Vulnerability in OpenMage Magento LTS Products
CVE-2026-128046

9.2CRITICAL

Key Information:

Vendor

Openmage

Status
Magento-lts
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128046?

The OpenMage Magento LTS versions prior to 20.18.2 and between 21.0.0-beta1 and 21.0.0-beta3 are vulnerable due to an unrestricted file upload issue stemming from a missing blocklist entry for certain file types. This flaw allows unauthenticated attackers to exploit file custom options to upload malicious .phar files. When executed on servers that misconfigure their handling of .phar files as PHP, this vulnerability offers a direct avenue for remote code execution, potentially compromising the security of the entire web application.

Affected Version(s)

magento-lts 20.17.0 < 20.18.2

magento-lts 21.0.0-beta1 < 21.0.0-beta3

magento-lts 20.18.2

References

https://github.com/OpenMage/magento-lts/security/advisori...
vendor-advisory
https://github.com/OpenMage/magento-lts/commit/ba76b2346f...
patch
https://github.com/OpenMage/magento-lts/commit/5b6f985785...
patch

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpitjain099
4n86rakam1
colinmollenhour
Hanmac
.