CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
Attackers can upload malicious files with bypassed extensions to achieve remote code execution if server execution restrictions are not configured.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40488?
CVE-2026-40488 is a high-severity vulnerability in OpenMage magento-lts, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.
Weakness: CWE-434
Which versions are affected by CVE-2026-40488?
2 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openmage/magento-lts Packagist | All versions | 20.17.0 |
openmage/magento-lts Packagist | All versions | 20.17.0 |
Products include Openmage Magento.
How do I fix CVE-2026-40488?
Upgrade openmage/magento-lts to 20.17.0 or later.
Is CVE-2026-40488 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40488 exists.
Other vulnerabilities in OpenMage magento-lts
- CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper
- CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2
- CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update
- CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution
- CVE-2020-15244 RCE in Magento
Sources
Also known as GHSA-3j5q-7q7h-2hhv.