Path traversal in magento-lts - #VU158638
Published: November 2, 2026
Vulnerability identifier: #VU158638
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to read image files outside the media directory.
The vulnerability exists due to path traversal in mediaDirective() when joining the supplied url parameter to the media directory without a containment check. A remote privileged user can submit a directive such as {{media url="../…"}} to the cms_wysiwyg/directive endpoint with CMS access to read image files outside media/ that the web server user can open.
Text resources such as configuration files and metadata JSON cannot be read back because GD rejects them.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3