PT-2026-38267 · Openmage+2 · Magento-Lts+1

CVE-2026-42458

·

Published

2026-05-06

·

Updated

2026-05-18

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Name of the Vulnerable Software and Affected Versions Magento Long Term Support (LTS) versions prior to 20.18.0
Description A reflected cross-site scripting (XSS) issue exists within the admin panel under System -> Import/Export -> Dataflow - Profiles. The flaw occurs when a filename is reflected in HTML tags without proper sanitization. An attacker can exploit this by manipulating the filename in the request to the endpoint "/index.php/admin/system convert gui/run/" via the files variable, allowing the execution of arbitrary JavaScript in the context of the user's session.
Recommendations Update to version 20.18.0.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-87

Related Identifiers

CVE-2026-42458
GHSA-X8JV-Q8J2-487C

Affected Products

Magento-Lts
Openmage Magento Lts