CVE-2026-25525

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6vqf-6fhm-7rc6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Magento Long Term Support (LTS) es un proyecto no oficial, impulsado por la comunidad, que proporciona una alternativa a la plataforma de comercio electrónico Magento Community Edition con un alto nivel de compatibilidad con versiones anteriores. Antes de la versión 20.17.0, el módulo Dataflow en OpenMage LTS utiliza un filtro de lista negra débil (’str_replace(’.. / ’, ’’, $input)’) para prevenir ataques de salto de ruta. Este filtro puede ser eludido utilizando patrones como ’... / ./’ o ’.... / /’, que después del reemplazo aún resultan en ’.. / ’. Un administrador autenticado puede explotar esto para leer archivos arbitrarios del sistema de archivos del servidor. La versión 20.17.0 corrige el problema.

Information

Published : 2026-04-20 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-25525

Mitre link : CVE-2026-25525

CVE.ORG link : CVE-2026-25525

JSON object : View

Products Affected

openmage

magento

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-184

Incomplete List of Disallowed Inputs

{"id": "CVE-2026-25525", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25525", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T13:27:13.684152Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenMage", "product": "magento-lts", "versions": [{"status": "affected", "version": "< 20.17.0"}]}]}], "published": "2026-04-20T17:16:32.460", "references": [{"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6vqf-6fhm-7rc6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-184"}]}], "descriptions": [{"lang": "en", "value": "Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue."}, {"lang": "es", "value": "Magento Long Term Support (LTS) es un proyecto no oficial, impulsado por la comunidad, que proporciona una alternativa a la plataforma de comercio electr\u00f3nico Magento Community Edition con un alto nivel de compatibilidad con versiones anteriores. Antes de la versi\u00f3n 20.17.0, el m\u00f3dulo Dataflow en OpenMage LTS utiliza un filtro de lista negra d\u00e9bil (\u2019str_replace(\u2019.. / \u2019, \u2019\u2019, $input)\u2019) para prevenir ataques de salto de ruta. Este filtro puede ser eludido utilizando patrones como \u2019... / ./\u2019 o \u2019.... / /\u2019, que despu\u00e9s del reemplazo a\u00fan resultan en \u2019.. / \u2019. Un administrador autenticado puede explotar esto para leer archivos arbitrarios del sistema de archivos del servidor. La versi\u00f3n 20.17.0 corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "D3D78A44-3FCF-4E81-9A3C-A66A99CC489D", "versionEndExcluding": "20.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}