Interpretation Conflict in magento-lts - #VU158630
Published: November 2, 2026
Vulnerability details
The vulnerability allows a remote privileged user to read and write arbitrary files as the web server user and execute arbitrary code on deployments where the document root is writable.
The vulnerability exists due to an interpretation conflict between namespace-aware XPath checks in Mage_Core_Model_Layout_Validator and namespace-insensitive element handling in Mage_Core_Model_Layout::generateBlocks() when processing custom layout XML. A remote privileged user can save a product layout update containing an action element with a default XML namespace and a helper attribute, then request the product page to bypass validation and invoke arbitrary helper methods, including a file-merge helper that reads and writes files as the web server user.