CVE-2021-32759 Data Flow Sanitation Issue Fix

What is CVE-2021-32759?

CVE-2021-32759 is a high-severity vulnerability in OpenMage magento-lts, published on 27 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.

Weakness: CWE-20

Which versions are affected by CVE-2021-32759?

4 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.

Products include Openmage Magento.

How do I fix CVE-2021-32759?

Upgrade openmage/magento-lts to a fixed version for your release line: 19.4.15 or 20.0.13.

Is CVE-2021-32759 being exploited?

There is no known exploitation of CVE-2021-32759 in the wild and no public exploit code.

Other vulnerabilities in OpenMage magento-lts

• CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper Critical 9.8
• CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2 Critical 9.1
• CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update High 8.8
• CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution High 8.7
• CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xm9f-vxmx-4m58.