OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
Date: 2026-04
Affected: composer/openmage/magento-lts
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-25524
CVE-2026-25525
CWE: CWE-184
CWE-22
CWE-502
CVSS: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

The Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. | Metric | Value | Justification | | ------------------------ | --------- | ------------------------------------- | | Attack Vector (AV) | Network | Exploitable via admin panel | | Attack Complexity (AC) | Low | Simple bypass pattern | | Privileges Required (PR) | High | Requires admin authentication | | User Interaction (UI) | None | No additional user interaction needed | | Scope (S) | Unchanged | Impacts the vulnerable component | | Confidentiality (C) | High | Can read sensitive system files | | Integrity (I) | None | Read-only vulnerability | | Availability (A) | None | No impact on availability | ## Affected Products - OpenMage LTS versions < 20.16.1 - All versions derived from Magento 1.x with these code paths ## Affected Files | File | Line | Vulnerable Code | | ------------------------------------------------------------ | ---- | ------


Mitigations:

Architectural layers (MAESTRO):