CVE-2026-40488

HighPublic PoC

Published: 20 April 2026

Published

20 April 2026

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 23.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40488 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Openmage Magento. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires comprehensive server-side validation of file uploads to block dangerous PHP-executable extensions like .phtml and .phar, directly preventing the blocklist bypass leading to RCE.

CM-6 Configuration Settings good match

prevent

Mandates secure web server configuration settings to deny script execution in publicly accessible upload directories such as media/custom_options/quote/.

SI-2 Flaw Remediation good match

prevent

Requires monitoring for vulnerabilities like CVE-2026-40488 and timely application of patches such as OpenMage LTS version 20.17.0 to remediate the incomplete file upload blocklist.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

CVE enables exploitation of a public-facing web application (T1190) via unrestricted file upload bypass, allowing deployment of PHP web shells for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS…

uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.

Deeper analysisAI

CVE-2026-40488 affects OpenMage LTS, an unofficial community-driven project providing long-term support for the Magento Community Edition e-commerce platform with high backward compatibility. Prior to version 20.17.0, the product custom option file upload feature implements an incomplete blocklist of forbidden extensions limited to `php` and `exe`. This allows trivial bypass using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Uploaded files are stored in the publicly accessible `media/custom_options/quote/` directory, which may lack server-side execution restrictions in some configurations, potentially enabling remote code execution (RCE). The vulnerability is rated 8.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

A low-privileged remote attacker, such as an authenticated user with access to upload custom product options (e.g., a registered customer), can exploit this by uploading a malicious PHP file with a bypassable extension. If the web server configuration permits script execution in the `media/custom_options/quote/` directory, the attacker can then access the file via its public URL to trigger RCE, achieving high-impact confidentiality, integrity, and availability compromises on the server.

The GitHub Security Advisory (GHSA-3j5q-7q7h-2hhv) for OpenMage LTS confirms that version 20.17.0 resolves the issue by patching the blocklist and upload handling. Security practitioners should upgrade to 20.17.0 or later and verify web server configurations to deny script execution in the affected directory as an interim mitigation.