CVE-2026-40488

CVE-2026-40488 affects OpenMage LTS versions prior to 20.17.0, a community-maintained e-commerce platform. The vulnerability exists in the custom option file upload functionality, which uses an incomplete blocklist (php, exe) that can be easily bypassed using alternative PHP-executable extensions such as phtml, phar, php3-php7, and pht. When combined with inadequate server-side execution restrictions in the publicly accessible media/custom_options/quote/ directory, this flaw enables unauthenticated remote code execution on affected systems. The attack vector is network-based and appears to have low complexity, requiring only the ability to upload a file with an alternative PHP extension and access to a web server without explicit script execution denial in the media directory. The potential impact is severe, allowing attackers to execute arbitrary code with web server privileges and potentially gain full system compromise. The vulnerability is currently on the active Hot List but has not yet appeared in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no confirmed active exploitation in the wild at this time. However, the straightforward nature of the bypass technique and the relatively high FAUCET Risk Score of 51.0/100 indicate significant community attention and risk potential. Organizations running OpenMage LTS should upgrade to version 20.17.0 or implement directory-level execution restrictions as a mitigation measure.