High 8.7Published Apr 20, 2026

CVE-2026-40488OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution

Updated under an hour ago (Oct 26, 2026, 3:10 AM ET)

Does this affect you?

It affects OpenMage magento-lts and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for OpenMage magento-lts

Exploited in the last 30 days

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-434
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Apr 20, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

OpenMage magento-lts openmage:magento_lts (from the name)	before 20.17.0	CNA record
openmage magento openmage:magento	before 20.17.0	NVD

References

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3j5q-7q7h-2hhvx-refsource-confirm, exploit, vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.