CVE-2020-26285

Katalog CVE

CVSS 7.2 · High EPSS 2,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada openmage. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

Rincian

Terbit di NVD

21 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenMage/magento-lts/commit/4132668f5009f17456fe644742026f56d2297586 patch · advisory pihak ketiga
• https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10 advisory pihak ketiga
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hj6w-xrv3-wjj9 advisory pihak ketiga