GitHub Security Advisory: GHSA-fg79-cr9c-7369
Package: openmage/magento-lts (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 20.17.0
Patched in: 20.17.0

Summary: OpenMage LTS: Phar Deserialization leads to Remote Code Execution

Details:
PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution.

| Metric                   | Value     | Justification                                    |
| ------------------------ | --------- | ------------------------------------------------ |
| Attack Vector (AV)       | Network   | Exploitable via file upload and web requests     |
| Attack Complexity (AC)   | High      | Requires file upload + triggering phar:// access |
| Privileges Required (PR) | None      | Some upload vectors don't require authentication |
| User Interaction (UI)    | None      | Exploitation is automatic once triggered         |
| Scope (S)                | Unchanged | Impacts the vulnerable component                 |
| Confidentiality (C)      | High      | Full system access via RCE                       |
| Integrity (I)            | High      | Arbitrary code execution                         |
| Availability (A)         | High      | Complete system compromise possible              |

## Affected Products

- OpenMage LTS versions < 20.16.1
- All versions derived from Magento 1.x with these code paths

## Affected Files

| File                                                      | Line | Vulnerable Function                            |
| --------------------------------------------------------- | ---- | ---------------------------------------------- |
| `app/code/core/Mage/Core/Model/File/Validator/Image.php`  | 72   | `getimagesize($filePath)`                      |
| `app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php` | 137  | `getimagesize($item->getFilename())`           |
| `lib/Varien/Image.php`                                    | 71   | `$this->_getAdapter()->open($this->_fileName)` |

## Vulnerability Details

PHP's phar (PHP Archive) format stores metadata that is serialized. When PHP's stream wrapper functions access a file using the `phar://` protocol, the metadata is automatically deserialized. This occurs even with seemingly safe functions like `file_exists()` or `getimagesize()`.

A polyglot file can be crafted that is both a valid image (passing initial validation) and a valid phar archive containing malicious serialized objects. When the application later processes this file using `phar://`, the deserialization triggers a gadget chain leading to RCE.

### Attack Flow

1. **Create polyglot file**: Attacker creates a file that is both valid JPEG and valid PHAR
2. **Upload file**: Attacker uploads the polyglot via product images, CMS media, or import
3. **Trigger phar:// access**: Attacker causes the application to access the file using `phar://` wrapper
4. **Code executi