CVE-2020-26285

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

• CWE-22
• CWE-434

• https://github.com/OpenMage/magento-lts/commit/4132668f5009f17456fe644742026f56d2297586Patch, Third Party Advisory
• https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10Third Party Advisory
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hj6w-xrv3-wjj9Third Party Advisory
• https://github.com/OpenMage/magento-lts/commit/4132668f5009f17456fe644742026f56d2297586Patch, Third Party Advisory
• https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10Third Party Advisory
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hj6w-xrv3-wjj9Third Party Advisory

Published

Jan 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2628Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26280OpenSlides is a free, Web-based presentation and assembly sy…8.9
• CVE-2020-26281async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates…7.5
• CVE-2020-26282BrowserUp Proxy allows you to manipulate HTTP requests and r…10
• CVE-2020-26283go-ipfs is an open-source golang implementation of IPFS whic…8.8
• CVE-2020-26284Hugo is a fast and Flexible Static Site Generator built in G…8.5
• CVE-2020-26286HedgeDoc is a collaborative platform for writing and sharing…7.5
• CVE-2020-26287HedgeDoc is a collaborative platform for writing and sharing…8.7
• CVE-2020-26288Parse Server is an open source backend that can be deployed …6.5
• CVE-2020-26289date-and-time is an npm package for manipulating date and ti…7.5
• CVE-2020-2629Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26290Dex is a federated OpenID Connect provider written in Go. In…9.6