CVE-2020-26295: openmage

csirt@kutim:~/threat-intel/cve/CVE-2020-26295

CVSS 7.2 · High EPSS 1,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada openmage. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

Rincian

Terbit di NVD: 21 Januari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 1,8% peluang dieksploitasi; lebih tinggi dari 77,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openmage	openmage	Semua versi sebelum 19.4.10
openmage	openmage	Versi 20.0.0 hingga sebelum 20.0.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/OpenMage/magento-lts/commit/9cf8c0aa1d1306051a18ace08d40279dadc1fb35 patch · advisory pihak ketiga
https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10 advisory pihak ketiga
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-52c6-6v3v-f3fg advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.