CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Attackers can achieve remote code execution by uploading malicious phar files disguised as images, triggering unsafe deserialization in OpenMage LTS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25524?
CVE-2026-25524 is a high-severity unsafe deserialization vulnerability in OpenMage magento-lts, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution. Version 20.17.0 patches the issue.
Weakness: CWE-502
Which versions are affected by CVE-2026-25524?
2 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openmage/magento-lts Packagist | All versions | 20.17.0 |
openmage/magento-lts Packagist | All versions | 20.17.0 |
Products include Openmage Magento.
How do I fix CVE-2026-25524?
Upgrade openmage/magento-lts to 20.17.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-25524 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25524 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in OpenMage magento-lts
- CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper
- CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2
- CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update
- CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
- CVE-2020-15244 RCE in Magento
Sources
Also known as GHSA-fg79-cr9c-7369.