External risk intelligence

OpenMage Magento-LTS Unrestricted File Upload Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-128046

OpenMage is an e-commerce platform specifically designed to be deployed as a public-facing web application. This vulnerability affects product file upload functionality, which is a core, internet-facing feature intended for interaction with the public. Because it is a web storefront, the application is public-facing by design, making the vulnerable endpoint reachable to anyone on the internet.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the OpenMage magento-lts platform that could allow unauthenticated attackers to upload malicious files and execute code on affected servers. This issue stems from an incomplete list of disallowed file extensions within the platform's file handling. At a high level, this could pose a risk to the integrity and availability of systems running this e-commerce software.

Attackers can upload malicious files.
Critical function allows code execution.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can leverage this vulnerability by uploading a malicious `.phar` file through a product's custom file option. The system's failure to properly block extensions like `phar`, `php8`, and `phps` allows this file to be saved to a predictable location on the server. If the server is configured to process `.phar` files as PHP and serve them directly from that directory, the attacker can then request the uploaded file to achieve code execution.

Upload malicious file via product option.
System fails to block dangerous file extensions.
Enables unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code on servers running affected versions of OpenMage. This could occur when a product's custom file option is used to upload a specially crafted ".phar" file, which is then directly requested and processed by the server as PHP code. The impact is a complete compromise of the server.

Server code execution risk.
Unrestricted file upload allows code.
Full server compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, an unrestricted file upload in OpenMage, likely impacts teams responsible for e-commerce platforms and their associated infrastructure. The immediate practical step is to identify all instances of the affected software, determine their exposure and business criticality, and then assign an owner for remediation planning.

E-commerce platform owners should address.
Verify reachability and business criticality first.
Plan remediation and coordinate with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenMage magento-lts?

OpenMage magento-lts is an open-source e-commerce platform derived from Magento 1. It provides the framework for online stores to manage product catalogs, customer transactions, and order processing. Because it handles public-facing storefronts, it relies on various file upload features to allow customers or administrators to attach documents or images to products.

What is the weakness behind CVE-2026-128046?

This vulnerability is an unrestricted file upload, classified as CWE-184 (Incomplete List of Disallowed Inputs). The software uses a blocklist to prevent dangerous file types from being uploaded, but that list fails to include extensions like .phar, .php8, and .phps. Because these extensions are not restricted, the system inadvertently accepts files that can be executed as code by the server.

How can an attacker trigger this vulnerability?

An unauthenticated attacker triggers this by using a product's 'File' custom option to upload a malicious file with a .phar extension. The attack only succeeds if the web server is configured to treat .phar files as executable PHP scripts. Simply uploading the file is insufficient; the server must also be configured to serve files directly from the directory where these custom options are saved.

Is my server at risk if it is internal only?

According to Halo Surface Signal, this vulnerability is particularly concerning for OpenMage because the software is designed as a public-facing e-commerce storefront. Since the vulnerable file upload feature is a core component intended for web interaction, the endpoint is reachable by anyone on the internet. Servers exposed to the public internet are at the highest risk of being targeted by this flaw.

What should I do if I run OpenMage?

Start by identifying all instances of OpenMage magento-lts within your environment to see if they fall within the affected version ranges. Evaluate the reachability of your e-commerce storefronts and prioritize remediation for those facing the internet. Coordinate with your technical team to plan an update to a secure version that properly enforces file extension restrictions, and review your server's execution policies for the media directory.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.