The vulnerability lies in an incomplete file upload blocklist for customer options in OpenMage LTS. The system allows uploads with extensions such as .phtml, .phar, .php3, .php4, .php5, .php7, or .pht, bypassing the intended filters. Uploaded files are stored in the publicly accessible media/custom_options/quote/ directory. If that directory is capable of executing scripts on the server, an attacker can upload a malicious file and run arbitrary code, resulting in full remote code execution. This flaw is classified as CWE‑434, an unrestricted upload of dangerous file content.

All installations of OpenMage LTS that are running a version earlier than 20.17.0 are affected. The specific product is the Magento Community Edition support by the OpenMage project. Versions 20.17.0 and later incorporate the fix and are no longer vulnerable.

The CVSS score of 8.7 indicates high severity. Although the EPSS score is not available, the vulnerability has a clear path to exploitation via the web interface. The KEV catalog does not list this CVE, but that does not diminish the risk posed by the ability to upload files to an execution‑permitted directory. If the server allows script execution in media/custom_options/quote/, the attacker can achieve complete compromise of the application and potentially the underlying server. If execution is not allowed, the risk is reduced but the vulnerability still permits file upload abuse that could lead to other attacks.