OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an information disclosure vulnerability in the Mage_Rss_Model_Resource_Order::getAllCommentCollection() function. This flaw allows authenticated customers to access internal staff comments, such as fraud-review and payment notes, by opening the /rss/order/status feed for their orders. The vulnerability arises because the is_visible_on_front filter is omitted for invoice, shipment, and credit-memo comments, exposing sensitive internal information.
OpenMage magento-lts versions prior to 20.19.0 and 21.0.0-beta1 prior to 21.0.0-beta3 have a cross-site request forgery (CSRF) vulnerability in the PayPal cancel and decline return handlers. These handlers trust the checkout session without verifying that the request originated from PayPal. An attacker can exploit this by tricking a shopper into making a cross-site GET request to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 use weak methods to generate customer email confirmation keys and password-reset tokens. The keys are generated using md5(uniqid()) and uniqHash(), which are not cryptographically secure. This allows unauthenticated attackers to brute-force confirmation keys via an unrate-limited endpoint, potentially logging in as pending customers or predicting administrator reset tokens after recovering the generator state.
A vulnerability in OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 allows restricted administrators with access to Transactional Emails to read decrypted configuration secrets. This occurs because the store.getConfig email template directive's encrypted-path check fails to cover certain config.xml-declared paths, case variants of the getConfig method, and parent paths. Exploiting this flaw enables exposure of sensitive credentials such as PayPal, payment gateway, and carrier information.
OpenMage magento-lts versions before 20.18.2 and 21.x before 21.0.0-beta3 have a vulnerability in OAuth 1.0a callback URL validation. The software uses a string-prefix check and falls back to accepting any well-formed URL, allowing attackers with leaked consumer keys and secrets to manipulate callback URLs. This enables capturing of request tokens and verifiers from administrators or customers, potentially leading to unauthorized access tokens with victim API privileges.
OpenMage Magento LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have a critical cross-site request forgery (CSRF) vulnerability in the admin and storefront OAuth confirm actions. These actions accept GET requests without form-key validation, allowing attackers with OAuth consumer credentials to trick logged-in administrators or customers into authorizing malicious OAuth tokens. This can lead to persistent REST API access tokens bound to the victim.
OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 have an authorization vulnerability in the template filter's {{layout}} directive. This flaw allows administrators with content editing rights to embed {{layout}} with arbitrary layout handles, bypassing the whitelist enforcement applied to the {{block}} directive. This can lead to rendering of disallowed blocks and limited information disclosure.
OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an authorization bypass vulnerability in the /rss/order/status feed. The vulnerability arises because the URL key is an unsigned Base64-encoded JSON containing order, increment, and customer IDs. This allows unauthenticated attackers to forge keys by enumerating sequential IDs and access other customers' order details, including names, items, prices, totals, and status comments, when the order-status RSS feed is enabled.
FrankenPHP versions before 1.13.0 have a vulnerability in the splitPos function in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php within a filename component. This bypasses route-level or WAF deny rules and enables attackers to manipulate PHP environment variables such as PATH_INFO, SCRIPT_NAME, and PHP_SELF.
OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contain a race condition vulnerability in the shopping cart price rule usage limits. This flaw arises because the coupon usage counters are checked and incremented without proper locking, allowing unauthenticated attackers, including guest users, to redeem limited-use coupons more times than intended.
FrankenPHP Docker images prior to version 1.1.11 were rebuilt only when new base image tags were released. This practice caused security fixes applied to Alpine, PHP, and Go under existing tags not to be propagated, leaving system libraries stale. Remote attackers could exploit known vulnerabilities in these outdated libraries, such as CVE-2025-15467 in libcrypto3, to execute arbitrary code. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a vulnerability where the 'free' payment method (which requires no payment information) can be exploited to place unpaid orders with a non-zero total. This occurs because the zero-total check is only performed when payment data is imported, allowing an API user with cart permissions to manipulate the cart and bypass payment requirements.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability in the Dataflow profile run page. This flaw allows unauthenticated attackers to inject malicious markup via the store, type, or attribute_set columns of an import file, which is then executed in the session of an administrator who imports the file.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability in the Mage_Catalog_Model_Product_Option_Type_File component. This flaw allows unauthenticated attackers to upload SVG, XHTML, or XML files through product file custom options when the allowed-extension list is empty. Attackers can then send crafted file URLs to victims, causing script execution in the store's origin and potentially exposing administrator sessions if the admin panel shares the same origin.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serve RSS feeds with a text/html content type and do not escape feed entry data, leading to stored cross-site scripting (XSS). An unauthenticated guest can submit a product review containing malicious script in the nickname, title, or text fields. This script executes when an administrator views the pending-reviews RSS feed, potentially allowing admin account takeover.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an insufficient session expiration vulnerability. The issue arises because the session renewal function does not verify if the API user is active, and REST OAuth authorization does not check admin user activity status. This allows attackers with existing SOAP/XML-RPC sessions or OAuth tokens to maintain API access even after user deactivation or API key rotation, enabling unauthorized reading and modification of customer, order, and catalog data.
FrankenPHP versions from 1.5.0 up to but not including 1.13.0 have an environment sandbox vulnerability where putenv modifies the process-wide OS environment. This causes leakage of environment variables, including secrets like database passwords, across concurrent requests when child processes are spawned with default environments.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain admin page variables are rendered without proper escaping, allowing an attacker with limited admin access to inject malicious scripts. These scripts execute when another administrator accesses the affected pages, potentially allowing theft of form keys and unauthorized actions with that administrator's privileges.
Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance.
FrankenPHP versions prior to 1.13.2 have a resource exhaustion vulnerability that allows unauthenticated clients to consume PHP threads by sending many requests and disconnecting immediately. This prevents queued requests from being cancelled, causing thread pool delays and impacting service availability.