Server-Side Request Forgery (SSRF) in magento-lts - #VU158637
Published: November 2, 2026
Vulnerability details
The vulnerability allows a remote privileged user to make server-side requests to arbitrary HTTP(S) URLs, including internal hosts, and read image responses.
The vulnerability exists due to insufficient restriction of server-side request destinations in Mage_Adminhtml_Cms_WysiwygController::directiveAction() when filtering the base64-decoded ___directive request parameter and passing the result to the GD image adapter. A remote privileged user can submit template directives such as {{protocol}} with CMS access to cause the server to fetch an attacker-chosen URL and return decodable image content.
Responses that GD cannot decode as images are replaced with a placeholder, making requests for other content blind.