CVE-2026-25524

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution. Version 20.17.0 patches the issue.

• CWE-502

• https://github.com/OpenMage/magento-lts/releases/tag/v20.17.0Release Notes
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fg79-cr9c-7369Exploit, Mitigation, Vendor Advisory

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25519OpenSlides is a free, web based presentation and assembly sy…9.8
• CVE-2026-2552A vulnerability was identified in ZenTao up to 21.7.8. Affec…5.5
• CVE-2026-25520SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
• CVE-2026-25521Locutus brings stdlibs of other programming languages to Jav…8.8
• CVE-2026-25522Craft Commerce is an ecommerce platform for Craft CMS. In ve…4.8
• CVE-2026-25523Magento-lts is a long-term support alternative to Magento Co…5.3
• CVE-2026-25525Magento Long Term Support (LTS) is an unofficial, community-…4.9
• CVE-2026-25526JinJava is a Java-based template engine based on django temp…9.8
• CVE-2026-25527changedetection.io is a free open source web page change det…5.3
• CVE-2026-25528LangSmith Client SDKs provide SDK's for interacting with the…5.8
• CVE-2026-25529Postal is an open source SMTP server. Postal versions less t…8.1
• CVE-2026-2553A security flaw has been discovered in tushar-2223 Hotel-Man…6.3