The Dataflow module in OpenMage LTS before version 20.17.0 applies a weak blacklist filter that removes only the sequence ../ from input. Patterns such as ..././ or ....// still leave a ../ after the replacement, allowing the resolved path to contain traversal. An attacker with administrator credentials can supply these patterns to read any file on the server filesystem. This flaw is a path traversal weakness categorized as CWE-184 and CWE-22 and directly threatens the confidentiality of server files.

The vulnerability exists in any OpenMage LTS release prior to 20.17.0. All installations of OpenMage:magento-lts running a version earlier than 20.17.0 are affected. OpenMage LTS is an unofficial, community‑driven project providing a long‑term support branch of the Magento Community Edition.

The CVSS score of 4.9 places this in the medium severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Since the flaw requires authenticated administrator access, only users with such privileges can exploit it, but it gives them unrestricted ability to read any file on the server. The path traversal bypass is straightforward once the attacker knows the weak filter, so the attack vector is local with limited privilege escalation beyond the existing administrator role.