CVE-2026-25524
published 2026-04-20CVE-2026-25524: Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a…
PriorityP354high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.54%
41.2th percentile
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution. Version 20.17.0 patches the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openmage | magento | < 20.17.0 | 20.17.0 |
| openmage | magento-lts | < 20.17.0 | 20.17.0 |
| openmage | magento-lts | >= 0 < 20.17.0 | 20.17.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
ghsa·2026-04-21
CVE-2026-25524 [HIGH] CWE-502 OpenMage LTS: Phar Deserialization leads to Remote Code Execution
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution.
| Metric | Value | Justification |
| ------------------------ | --------- | ------------------------------------------------ |
| Attack Vector (AV) | Network | Exploitable via file upload and web requests |
| Attack Complexity (AC) | High | Requires file upload + triggering phar:// access |
VulDB
OpenMage magento-lts up to 20.16.x phar getimagesize/file_exists/is_readable deserialization (GHSA-fg79-cr9c-7369)
vuldb·2026-04-20·CVSS 8.1
CVE-2026-25524 [HIGH] OpenMage magento-lts up to 20.16.x phar getimagesize/file_exists/is_readable deserialization (GHSA-fg79-cr9c-7369)
A vulnerability classified as problematic was found in OpenMage magento-lts up to 20.16.x. This affects the function getimagesize/file_exists/is_readable of the component phar Handler. Such manipulation leads to deserialization.
This vulnerability is documented as CVE-2026-25524. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-20
Published