CVE-2025-27400: Magento vulnerable to stored XSS in theme config fields
As reported by Aakash Adhikari, Github: @justlife4x4, the Design > Themes > Skin (Images / CSS) config field allows a Stored XSS when it contains an end script tag.
Impact A malicious user with access to this configuration field could use a Stored XSS to affect other authenticated admin users in the admin panel.
The attack requires an admin user with configuration access, so in practice, it is not very likely to be used for gaining elevated privileges, although it could theoretically be used to impersonate other users.
!image
Other sources
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.
— MITRE
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.1 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.1 contain a patch for the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.12.3 - Upgrade
Upgrade
Magento (community edition / LTS)to a version that resolves this vulnerability.Fixed in 20.12.3 - Upgrade
Upgrade
Magento (community edition / LTS)to a version that resolves this vulnerability.Fixed in 20.13.0 - Upgrade
Upgrade
Magento (community edition / LTS)to a version that resolves this vulnerability.Fixed in 20.13.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27400?
CVE-2025-27400 is classified as a high severity vulnerability due to its potential to allow unauthorized script execution.
How do I fix CVE-2025-27400?
To fix CVE-2025-27400, upgrade Magento Long Term Support to version 20.12.3 or 20.13.1.
Which versions are affected by CVE-2025-27400?
CVE-2025-27400 affects Magento Long Term Support versions before 20.12.3 and 20.13.1.
What type of vulnerability is CVE-2025-27400?
CVE-2025-27400 is a script execution vulnerability that may compromise the security of the affected system.
Is CVE-2025-27400 publicly disclosed?
Yes, CVE-2025-27400 has been publicly disclosed and is documented in various security advisories.