CVE-2026-128028: OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in MageCatalogModelProductOptionTypeFile, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/customoptions/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
OpenMage magento-lts versions before 20.18.2 are affected, as are 21.0.0 beta releases before 21.0.0-beta3. Exposure requires product File custom options configured with an empty allowed-extension list, which permits guest uploads of SVG, XHTML, or XML files.
What must an attacker do to exploit this issue?
An unauthenticated attacker must upload a malicious SVG, XHTML, or XML file through a product File custom option and persuade a victim to open its URL under media/custom_options/. Exploitation has high attack complexity and requires victim interaction.
When are administrator sessions at risk?
Administrator sessions may be exposed when the admin panel shares the same origin as the storefront where the malicious uploaded file executes. The script runs in the store origin after a victim visits the uploaded file URL.
What can be done if an update cannot be applied immediately?
Ensure product File custom options do not use an empty allowed-extension list, since that condition allows the affected guest uploads. Restricting the accepted file extensions prevents the described SVG, XHTML, and XML upload path.