CVE-2026-128046: OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protectedextensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/customoptions path and request it directly to execute code on servers that map .phar to PHP and serve that directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 20.18.2 - Upgrade
Upgrade
OpenMage magento-ltsto a version that resolves this vulnerability.Fixed in 21.0.0-beta3
Event History
Frequently Asked Questions
Which deployments are exposed to remote code execution?
Affected deployments are OpenMage magento-lts 20.17.0 through versions before 20.18.2, and 21.0.0-beta1 through versions before 21.0.0-beta3. Exploitation also requires the server to map .phar files to PHP and to serve the media/custom_options directory.
Does exploitation require an account or user interaction?
No. An unauthenticated attacker can upload a .phar file through a product File custom option and then request the uploaded file directly.
What configuration condition makes this exploitable?
The vulnerable protected-extension blocklist does not include phar, php8, or phps. The described RCE path specifically depends on .phar files being handled as PHP by the server.
What should be checked to identify current exposure?
Check whether the deployment is running a version before 20.18.2 in the 20.x line or before 21.0.0-beta3 in the 21.0.0 beta line. Also verify whether product File custom options permit uploads, whether uploaded files are reachable under media/custom_options, and whether .phar is executed as PHP.