CVE-2026-25525

OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module

State: Published
Severity: 4.9 Medium
Published: Apr 20, 2026
Updated: Apr 21, 2026
Reserved: Feb 2, 2026

Description

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-184 Incomplete List of Disallowed Inputs

Affected Products

Product	Versions
magento-ltsOpenMage	< 20.17.0Affected

References

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6vqf-6fhm-7rc6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.