Fix for arbitrary file deletion in customer media allows for remote code execution
Date: 2023-01
Affected: composer/openmage/magento-lts, composer/openmage/magento-lts
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2021-21395
CVE-2021-41143
CWE: CWE-22
CWE-352
CWE-77
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

### Impact Magento admin users with access to the customer media could execute code on the server.


Mitigations:

Architectural layers (MAESTRO):