CVE-2021-41231 OpenMage LTS DataFlow upload remote code execution vulnerability

What is CVE-2021-41231?

CVE-2021-41231 is a high-severity vulnerability in OpenMage magento-lts, published on 27 Jan 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

Weakness: CWE-434, CWE-77

Which versions are affected by CVE-2021-41231?

4 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.

Products include Openmage Magento.

How do I fix CVE-2021-41231?

Upgrade openmage/magento-lts to a fixed version for your release line: 19.4.22 or 20.0.19.

Is CVE-2021-41231 being exploited?

There is no known exploitation of CVE-2021-41231 in the wild and no public exploit code.

Other vulnerabilities in OpenMage magento-lts

• CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper Critical 9.8
• CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2 Critical 9.1
• CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update High 8.8
• CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution High 8.7
• CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h632-p764-pjqm.