Threats tagged 'ghsa-7h5v-m38x-m56w'

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability in the Mage_Catalog_Model_Product_Option_Type_File component. This flaw allows unauthenticated attackers to upload SVG, XHTML, or XML files through product file custom options when the allowed-extension list is empty. Attackers can then send crafted file URLs to victims, causing script execution in the store's origin and potentially exposing administrator sessions if the admin panel shares the same origin.