Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Magento Admin Users Can Execute Code on the Server

CVE-2021-41143 · published 3 years ago
Summary

Magento admin users with access to customer media files can run unauthorized code on the server. This is a serious security risk because it could allow hackers to take control of your store. Make sure to update to version 19.4.22 or 20.0.19 to fix this issue.

What to do
  • Update openmage magento-lts to version 19.4.22.
  • Update openmage magento-lts to version 20.0.19.
Affected software
Ecosystem VendorProductAffected versions
composer openmage magento-lts < 19.4.22
>= 20.0.0, < 20.0.19
Fix: upgrade to 19.4.22
– openmage magento < 19.4.22
>= 20.0.0, < 20.0.19
cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*
Original advisory text
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 c...
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.2 High
Exploitation
1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-77Command Injection
Timeline
Published27 Jan 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5vpv-xmcj-9q85 · GHSA
CVE-2021-41143 · NVD
CVE-2021-41143 · OSV
Track software like this
Free during beta