.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

openmage/magento-lts 20.17.0 vulnerabilities

26 advisories known · openmage/magento-lts@20.17.0 · 3 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 20.17.0

SEVERITYADVISORYPUBLISHED

CriticalMagento LTS has Weak API Session ID — Predictable MD5 of Time-Derived InputsGHSA-2cwr-gcf9-pvxrCVE-2026-42155Affected <20.18.0Fixed in 20.18.0OSV source ↗6 months ago

MediumMagento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`GHSA-qpgq-5g92-j5q8CVE-2026-42207Affected <20.18.0Fixed in 20.18.0OSV source ↗6 months ago

MediumMagento LTS: Reflected XSS - Import -> Data Flow (profiles) GHSA-x8jv-q8j2-487cCVE-2026-42458Affected <20.18.0Fixed in 20.18.0OSV source ↗6 months ago

Does not affect 20.17.0

SEVERITYADVISORYPUBLISHED

CriticalFixes a bug in Zend Framework's Stream HTTP WrapperGHSA-m496-x567-f98cCVE-2021-21426Affected <19.4.13, >=20.0.0 <20.0.9Fixed in 19.4.13 Fixed in 20.0.9OSV source ↗6 years ago

CriticalBackport for CVE-2021-21024 Blind SQLi from Magento 2GHSA-fvrf-9428-527mCVE-2021-21427Affected <19.4.13, >=20.0.0 <20.0.9Fixed in 19.4.13 Fixed in 20.0.9OSV source ↗6 years ago

HighOpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code ExecutionGHSA-3j5q-7q7h-2hhvCVE-2026-40488Affected <20.17.0Fixed in 20.17.0OSV source ↗7 months ago

HighFix for authenticated remote code execution through layout updateGHSA-5j2g-3ph4-rgvmCVE-2021-41144Affected <19.4.22, >=20.0.0 <20.0.19Fixed in 19.4.22 Fixed in 20.0.19OSV source ↗4 years ago

HighOpenMage LTS: Phar Deserialization leads to Remote Code ExecutionGHSA-fg79-cr9c-7369CVE-2026-25524Affected <20.17.0Fixed in 20.17.0OSV source ↗7 months ago

HighLayout XML Arbitrary Code Fix GHSA-26rr-v2j2-25fhCVE-2021-32758Affected <19.4.15, >=20.0.0 <20.0.13Fixed in 19.4.15 Fixed in 20.0.13OSV source ↗5 years ago

HighData Flow Sanitation Issue Fix GHSA-xm9f-vxmx-4m58CVE-2021-32759Affected <19.4.15, >=20.0.0 <20.0.13Fixed in 19.4.15 Fixed in 20.0.13OSV source ↗5 years ago

HighRCE via PHP Object injection via SOAP RequestsGHSA-jrgf-vfw2-hj26CVE-2020-15244Affected <19.4.8, >=20.0.0 <20.0.4Fixed in 19.4.8 Fixed in 20.0.4OSV source ↗6 years ago

HighObservable Timing Discrepancy in OpenMage LTSGHSA-crf2-xm6x-46p6BIT-magento-2020-15151CVE-2020-15151Affected <19.4.6, >=20.0.0 <20.0.2Fixed in 19.4.6 Fixed in 20.0.2OSV source ↗6 years ago

HighMagento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG EditorGHSA-9j5w-2cqc-cwj9Affected <20.2.0Fixed in 20.2.0OSV source ↗3 years ago

HighMagento LTS's guest order "protect code" can be brute-forced too easilyGHSA-9358-cpvx-c2qpCVE-2023-41879Affected <19.5.1, >=20.0.0 <20.1.1Fixed in 19.5.1 Fixed in 20.1.1OSV source ↗3 years ago

HighDataFlow upload remote code execution vulnerabilityGHSA-h632-p764-pjqmCVE-2021-41231Affected <19.4.22, >=20.0.0 <20.0.19Fixed in 19.4.22 Fixed in 20.0.19OSV source ↗4 years ago

HighFix for arbitrary file deletion in customer media allows for remote code executionGHSA-5vpv-xmcj-9q85CVE-2021-41143Affected <19.4.22, >=20.0.0 <20.0.19Fixed in 19.4.22 Fixed in 20.0.19OSV source ↗4 years ago

HighFix for arbitrary command execution in custom layout update through blocksGHSA-c9q3-r4rv-mjm7CVE-2021-39217Affected <19.4.22, >=20.0.0 <20.0.19Fixed in 19.4.22 Fixed in 20.0.19OSV source ↗4 years ago

MediumOpenMage vulnerable to XSS in Admin NotificationsGHSA-qv78-c8hc-438rCVE-2025-64174Affected <20.16.0Fixed in 20.16.0OSV source ↗last year

MediumOpenMage LTS: Cross-user wishlist import leads to private option & file disclosureGHSA-665x-ppc4-685wCVE-2026-40098Affected <20.17.0Fixed in 20.17.0OSV source ↗7 months ago

MediumMagento LTS vulnerable to stored XSS in admin file formGHSA-gp6m-fq6h-cjcxAffected <19.5.3, >=20.0.0 <20.5.0Fixed in 19.5.3 Fixed in 20.5.0OSV source ↗3 years ago

MediumMagento's X-Original-Url header can expose admin urlGHSA-jg68-vhv3-9r8fCVE-2026-25523Affected <20.16.1Fixed in 20.16.1OSV source ↗9 months ago

MediumOpenMage LTS has a Path Traversal Filter Bypass in Dataflow ModuleGHSA-6vqf-6fhm-7rc6CVE-2026-25525Affected <20.17.0Fixed in 20.17.0OSV source ↗7 months ago

Medium DoS vulnerability in MaliciousCode filterGHSA-3p73-mm7v-4f6mCVE-2023-23617Affected <19.4.22, >=20.0.0 <20.0.19Fixed in 19.4.22 Fixed in 20.0.19OSV source ↗4 years ago

Mediummagento-lts Reset Password not protected against well-timed CSRFGHSA-r3c9-9j5q-pwv4CVE-2021-21395Affected <19.4.22, >=20.0.0 <20.0.19Fixed in 19.4.22 Fixed in 20.0.19OSV source ↗4 years ago

MediumMagento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configsGHSA-5vrp-638w-p8m2CVE-2024-41676Affected <20.10.1Fixed in 20.10.1OSV source ↗2 years ago

LowMagento LTS vulnerable to stored XSS in theme config fieldsGHSA-5pxh-89cx-4668CVE-2025-27400Affected <20.12.3Fixed in 20.12.3OSV source ↗2 years ago