CVE-2026-128046

Name of the Vulnerable Software and Affected Versions OpenMage magento-lts versions 20.17.0 through 20.18.1 OpenMage magento-lts versions 21.0.0-beta1 through 21.0.0-beta2

Description An unrestricted file upload issue exists because the general/file/protected extensions blocklist fails to include phar, php8, and phps extensions. Unauthenticated attackers can upload a .phar file via a product File custom option to a predictable media/custom options path. If the server maps .phar files to PHP and serves that directory, the uploaded file can be requested directly to execute arbitrary code.

Recommendations Update OpenMage magento-lts versions 20.17.0 through 20.18.1 to version 20.18.2. Update OpenMage magento-lts versions 21.0.0-beta1 through 21.0.0-beta2 to version 21.0.0-beta3.