# openmage/magento-lts (Packagist) vulnerabilities 24 known vulnerabilities (3 critical, 11 high, 9 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/openmage/magento-lts ## Advisories (24) ### [CVE-2026-42207](https://cve.now/CVE-2026-42207): Magento LTS: Open Redirect via Unvalidated \`uenc\` Parameter in \`stockAction()\` - magento-lts - Severity: Medium 6.1 - Published: May 15, 2026 - Affected: fixed in 20.18.0. ### [CVE-2026-42155](https://cve.now/CVE-2026-42155): Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs - Severity: Critical 9.3 - Published: May 15, 2026 - Affected: fixed in 20.18.0. ### [CVE-2026-42458](https://cve.now/CVE-2026-42458): Magento LTS: Reflected XSS - Import -\> Data Flow (profiles) - Severity: Medium 5.3 - Published: May 15, 2026 - Affected: fixed in 20.18.0. ### [CVE-2026-40488](https://cve.now/CVE-2026-40488): OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution - Severity: High 8.7 - Published: Apr 20, 2026 - Affected: fixed in 20.17.0. ### [CVE-2026-40098](https://cve.now/CVE-2026-40098): OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant - Severity: Medium 5.3 - Published: Apr 20, 2026 - Affected: fixed in 20.17.0. ### [CVE-2026-25525](https://cve.now/CVE-2026-25525): OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module - Severity: Medium 4.9 - Published: Apr 20, 2026 - Affected: fixed in 20.17.0. ### [CVE-2026-25524](https://cve.now/CVE-2026-25524): OpenMage LTS's Phar Deserialization leads to Remote Code Execution - Severity: High 8.1 - Published: Apr 20, 2026 - Affected: fixed in 20.17.0. ### [CVE-2026-25523](https://cve.now/CVE-2026-25523): Magento's X-Original-Url header can expose admin url - Severity: Medium 5.3 - Published: Feb 4, 2026 - Affected: fixed in 20.16.1. ### [CVE-2025-64174](https://cve.now/CVE-2025-64174): OpenMage is vulnerable to XSS in Admin Notifications - Severity: Medium 4.6 - Published: Nov 6, 2025 - Affected: fixed in 20.16.0. ### [CVE-2025-27400](https://cve.now/CVE-2025-27400): Magento vulnerable to stored XSS in theme config fields - Severity: Low 2.9 - Published: Feb 28, 2025 - Affected: fixed in 20.12.3. ### [CVE-2024-41676](https://cve.now/CVE-2024-41676): Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs - Severity: Medium 4.1 - Published: Jul 29, 2024 - Affected: fixed in 20.10.1. ### [CVE-2023-41879](https://cve.now/CVE-2023-41879): Magento LTS's guest order "protect code" can be brute-forced too easily - Severity: High 7.5 - Published: Sep 11, 2023 - Affected: fixed in 19.5.1; from 20.0.0, fixed in 20.1.1. ### [CVE-2023-23617](https://cve.now/CVE-2023-23617): OpenMage LTS has DoS vulnerability in MaliciousCode filter - Severity: Medium 4.9 - Published: Jan 27, 2023 - Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19. ### [CVE-2021-41231](https://cve.now/CVE-2021-41231): OpenMage LTS DataFlow upload remote code execution vulnerability - Severity: High 7.2 - Published: Jan 27, 2023 - Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19. ### [CVE-2021-41144](https://cve.now/CVE-2021-41144): OpenMage LTS authenticated remote code execution through layout update - Severity: High 8.8 - Published: Jan 27, 2023 - Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19. ### [CVE-2021-41143](https://cve.now/CVE-2021-41143): OpenMage LTS arbitrary file deletion in customer media allows for remote code execution - Severity: High 7.2 - Published: Jan 27, 2023 - Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19. ### [CVE-2021-39217](https://cve.now/CVE-2021-39217): OpenMage LTS arbitrary command execution in custom layout update through blocks - Severity: High 7.2 - Published: Jan 27, 2023 - Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19. ### [CVE-2021-21395](https://cve.now/CVE-2021-21395): Magneto-lts vulnerable to Cross-Site Request Forgery - Severity: Medium 4.2 - Published: Jan 27, 2023 - Affected: fixed in 19.4.22; from 20.0.0, fixed in 20.0.19. ### [CVE-2021-32759](https://cve.now/CVE-2021-32759): Data Flow Sanitation Issue Fix - Severity: High 7.2 - Published: Aug 27, 2021 - Affected: fixed in 19.4.15; from 20.0.0, fixed in 20.0.13. ### [CVE-2021-32758](https://cve.now/CVE-2021-32758): Layout XML Arbitrary Code Fix - Severity: High 7.2 - Published: Aug 27, 2021 - Affected: fixed in 19.4.15; from 20.0.0, fixed in 20.0.13. ### [CVE-2021-21427](https://cve.now/CVE-2021-21427): Backport for CVE-2021-21024 Blind SQLi from Magento 2 - Severity: Critical 9.1 - Published: Apr 21, 2021 - Affected: fixed in 19.4.13; from 20.0.0, fixed in 20.0.9. ### [CVE-2021-21426](https://cve.now/CVE-2021-21426): Fixes a bug in Zend Framework's Stream HTTP Wrapper - Severity: Critical 9.8 - Published: Apr 21, 2021 - Affected: fixed in 19.4.13; from 20.0.0, fixed in 20.0.9. ### [CVE-2020-15244](https://cve.now/CVE-2020-15244): RCE in Magento - Severity: High 8.0 - Published: Oct 21, 2020 - Affected: fixed in 19.4.8; from 20.0.0, fixed in 20.0.4. ### [CVE-2020-15151](https://cve.now/CVE-2020-15151): Observable Timing Discrepancy in OpenMage LTS - Severity: High 8.0 - Published: Aug 19, 2020 - Affected: fixed in 19.4.6; from 20.0.0, fixed in 20.0.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/openmage/magento-lts Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.