CVE-2026-40488
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high lev…
Published Apr 20, 2026 · updated Jun 17, 2026 · openmage magento
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist ( ) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as , , , , , , and . Files are stored in the publicly accessible directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2026 · NIST NVD
Detected
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist ( ) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alter
Jun 17, 2026 · NIST NVD
Updated
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist ( ) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alter
Affected
- cpe openmage/magentoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40488
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40488
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS use
nvd.nist.gov