CVE-2026-42458: OpenMage Magento LTS Reflected XSS Vulnerability in Data Flow Profiles
Summary
CVE-2026-42458: Magento LTS: Reflected XSS - Import -> Data Flow (profiles). Affects openmage/magento-lts versions < 20.18.0. Fixed in 20.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenMage Magento LTS is an open-source e-commerce platform that enables businesses to create and manage online stores. It offers a wide range of features including product management, customer management, and order processing. However, it is susceptible to security vulnerabilities, including reflected cross-site scripting (XSS) attacks, which can compromise the integrity of the application and its users.
Vulnerability Detail
A reflected XSS vulnerability exists in the OpenMage Magento LTS under the admin panel's Import/Export section, specifically in the Dataflow Profiles. This vulnerability arises when an attacker can manipulate the filename parameter in the URL, leading to the execution of arbitrary HTML or JavaScript code in the context of the admin panel. The potential ramifications include cookie theft, unauthorized actions, and defacement of the admin interface. The vulnerability can be exploited by uploading a malicious file and then executing a crafted URL that reflects the input back to the user, allowing for the execution of injected scripts.
How To Fix
Minimum fixed version
20.18.0
This is the first release that contains the fix.
composer require openmage/magento-lts:20.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the admin panel or implement input validation to sanitize the filename parameter before it is rendered in the HTML. This can help mitigate the risk of XSS attacks until a patch is applied.
Conclusion
The reflected XSS vulnerability in OpenMage Magento LTS poses a significant risk to the security of the admin panel. It is crucial for users to update to the latest version to protect against potential exploits. Implementing additional security measures can further enhance the safety of the application.
See every vulnerability recorded for openmage/magento-lts →
FAQ
Reflected XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then reflected back to the user without being stored. This can lead to unauthorized actions or data theft.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to test your application without signing up.
The impacts include cookie theft, unauthorized access to sensitive information, and the ability to execute arbitrary scripts in the context of the admin panel, which can lead to further exploitation.
Yes, a patch is available in version 20.18.0 of OpenMage Magento LTS. It is recommended to update to this version or later to mitigate the vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for openmage/magento-lts.
