Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3j5q-7q7h-2hhv Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · openmageNVD modified 2026-10-26 22:10
Affected (CPE criteria) 1
cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*
References 1
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3j5q-7q7h-2hhv Exploit, Vendor Advisory