The vulnerability arises when PHP functions such as getimagesize(), file_exists(), and is_readable() process phar:// stream wrapper paths, causing deserialization of the phar archive. In OpenMage Magento LTS before version 20.17.0 these functions are invoked with user-controllable paths during image validation and media handling. An attacker who uploads a specially crafted phar file disguised as an image can trigger arbitrary PHP object deserialization, leading to remote code execution. The weakness is identified as CWE‑502.

Installations of OpenMage Magento LTS that run any version prior to 20.17.0 are affected. The issue is fixed in release v20.17.0 and later.

The CVSS score of 8.1 signals high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack path involves an attacker with the ability to upload a filerequest that is processed by the vulnerable functions; the exploit requires no additional configuration beyond the default upload mechanism. While no public exploits are documented, the absence from KEV and the high severity scores indicate that the opportunity for exploitation is substantial for an attacker who can influence file uploads.