CVE-2026-25525 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
An authenticated administrator can bypass path traversal filters in the Dataflow module to read arbitrary files from the server filesystem.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25525?
CVE-2026-25525 is a medium-severity path traversal vulnerability in OpenMage magento-lts, published on 20 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.
Which versions are affected by CVE-2026-25525?
2 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openmage/magento-lts Packagist | All versions | 20.17.0 |
openmage/magento-lts Packagist | All versions | 20.17.0 |
Products include Openmage Magento.
How do I fix CVE-2026-25525?
Upgrade openmage/magento-lts to 20.17.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25525 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25525 exists.
Other vulnerabilities in OpenMage magento-lts
- CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper
- CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2
- CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update
- CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
- CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Sources
Also known as GHSA-6vqf-6fhm-7rc6.