CVE-2026-25524

HIGH EPSS 41.3%

Published Apr 20, 20262mo ago · Modified Jun 17, 20262w ago

8.1 CVSS 3.1

High

Published Apr 20, 2026 2mo ago

Last Modified Jun 17, 2026 2w ago

Description

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution. Version 20.17.0 patches the issue.

CVSS Details

Base Score

8.1

Exploitability

2.2

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

41.3% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

Vendor	Product	Version	Range
openmage	magento	*	<20.17.0

References 2

github.com https://github.com/OpenMage/magento-lts/releases/tag/v20.17.0

Release Notes
github.com https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fg79-cr9c-7369

ExploitMitigationVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.