CVE-2026-25525
Description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (str_replace('../', '', $input)) to prevent path traversal attacks. This filter can be bypassed using patterns like ..././ or ....//, which after the replacement still result in ../. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openmage/magento-ltsPackagist | < 20.17.0 | 20.17.0 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/OpenMage/magento-lts/security/advisories/GHSA-6vqf-6fhm-7rc6nvdVendor AdvisoryExploitWEB
- github.com/advisories/GHSA-6vqf-6fhm-7rc6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25525ghsaADVISORY
- github.com/OpenMage/magento-lts/pull/5445ghsaWEB
- github.com/OpenMage/magento-lts/releases/tag/v20.17.0ghsaWEB
- hackerone.com/reports/3482926ghsaWEB
News mentions
0No linked articles in our index yet.