CVE-2026-25524

OVERVIEW CVE-2026-25524 is a critical remote code execution vulnerability affecting OpenMage LTS (Long Term Support), an unofficial community-maintained fork of the Magento Community Edition e-commerce platform. The vulnerability exists in versions prior to 20.17.0 and stems from unsafe deserialization when PHP file handling functions such as getimagesize(), file_exists(), and is_readable() process phar:// stream wrapper paths. An attacker can exploit this by uploading a malicious phar archive disguised as an image file, then triggering one of the vulnerable functions with a phar:// path during image validation or media handling operations. SEVERITY The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH) with a network-based attack vector requiring only low complexity and no user interaction. The attack requires high attack complexity but delivers severe impact across confidentiality, integrity, and availability, enabling full system compromise. The EPSS score of 0.000670 indicates this threat is emerging, though currently positioned at relatively lower probability compared to the broader CVE landscape. EXPLOITATION STATUS While not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-25524 appears on the active Hot List, indicating emerging community attention and potential exploitation activity. No public exploit code is currently documented in major repositories. Organizations running affected OpenMage LTS versions should prioritize patching to version 20.17.0 immediately, particularly if systems accept user-uploaded image files.