The vulnerability in OpenMage magento-lts (CVE-2026-40488) arises from an insufficient blocklist for file uploads in the custom option feature. The blocklist only forbids .php and .exe extensions but does not cover alternative PHP-executable extensions such as .phtml, .phar, .php3, .php4, .php5, .php7, and .pht. Uploaded files are stored in the media/custom_options/quote/ directory, which may be publicly accessible and lack execution restrictions, enabling attackers to upload and execute malicious code remotely. The issue is fixed in version 20.17.0.

Successful exploitation allows an attacker with low privileges to upload malicious files with executable extensions to a publicly accessible directory, potentially resulting in remote code execution. This can lead to full compromise of the affected system. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade to OpenMage magento-lts version 20.17.0 or later, which patches this vulnerability by improving the file upload filtering. Until upgrading, ensure that the media/custom_options/quote/ directory is configured on the server to explicitly deny script execution to prevent remote code execution. Patch status is not explicitly confirmed in the vendor advisory, so verify with official OpenMage sources for the latest remediation guidance.