Openmage

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Openmage product.

RSS Feeds for Openmage security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Openmage products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Openmage Sorted by Most Security Vulnerabilities since 2018

Openmage Magento14 vulnerabilities

Openmage Magento Lts1 vulnerability

Openmage1 vulnerability

Openmage Long Term Support1 vulnerability

By the Year

In 2026 there have been 5 vulnerabilities in Openmage with an average score of 6.1 out of ten. Last year, in 2025 Openmage had 1 security vulnerability published. That is, 4 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	5	6.10
2025	1	0.00
2024	1	4.80
2023	7	7.10
2022	0	0.00
2021	4	7.85
2020	2	7.60

It may take a day or so for new Openmage vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Openmage Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-40488	Apr 20, 2026	OpenMage LTS <=20.17 RCE via custom option .phtml/.php upload Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.
CVE-2026-40098	Apr 20, 2026	Magento LTS Wishlist Add-to-Cart Mis-Auth (v20.17.0) Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker use a valid shared wishlist code for wishlist A and a wishlist item ID belonging to victim wishlist B to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A. Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound. Version 20.17.0 patches the issue.	Magento
CVE-2026-25525	Apr 20, 2026	OpenMage LTS Dataflow Module Path Traversal Pre-20.17.0 Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.	Magento
CVE-2026-25524	Apr 20, 2026	OpenMage LTS RCE via PHAR deserialization before v20.17.0 Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution. Version 20.17.0 patches the issue.
CVE-2026-25523	Feb 04, 2026	Magento-lts 20.16.1: X-Original-Url header leaks admin URL (CVE-2026-25523) Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
CVE-2025-64174	Nov 06, 2025	Magento-lts Stored XSS via Admin Notification Grid (20.15.0) Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0.	Magento Lts
CVE-2024-41676	Jul 29, 2024	Magento LTS XSS in header config before 20.10.1 Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.	Magento
CVE-2023-41879	Sep 11, 2023	Magento LTS order view w/o auth via guest cookie before 19.5.1 (CVE202341879) Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.	Magento
CVE-2023-23617	Jan 28, 2023	Infinite Loop in Malicious Code Filter (OpenMage LTS <19.4.22/20.0.19) OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.	Magento
CVE-2021-41143	Jan 27, 2023	Remote Code Execution in OpenMage LTS Prior to 19.4.22 via Customer Media OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.	Magento