Is CVE-2026-42458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42458 being exploited in the wild.

How severe is CVE-2026-42458?

Medium severity, with a CVSS score of 4, published 15 May 2026.

Which products and versions are affected?

OpenMage < 20.18.0, <= 20.17.0; openmage/magento-lts (Packagist) <= 20.17.0, ECOSYSTEM:introduced=0,fixed=20.18.0.

Is there a fix for CVE-2026-42458?

Yes. openmage/magento-lts (Packagist): upgrade to 20.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42458 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42458?

Check whether you run OpenMage or openmage/magento-lts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42458: OpenMage Magento LTS reflected XSS in Dataflow Profiles

Q: Which products and versions are affected?

OpenMage < 20.18.0, <= 20.17.0; openmage/magento-lts (Packagist) <= 20.17.0, ECOSYSTEM:introduced=0,fixed=20.18.0.

Q: Is there a fix for CVE-2026-42458?

Yes. openmage/magento-lts (Packagist): upgrade to 20.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42458 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-42458?

Check whether you run OpenMage or openmage/magento-lts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42458 · Severity: medium · CVSS 4 · Published 2026-05-15

A security vulnerability exists in the administrative interface of OpenMage Magento LTS, an e-commerce platform. An attacker could trick an administrator into clicking a malicious link, allowing the attacker to execute unauthorized scripts in the administrator's browser. This could lead to the theft of sensitive session cookies, account takeover, or unauthorized changes to the store's configuration.

Technologies: OpenMage, openmage/magento-lts (Packagist). Vendors: OpenMage, Packagist.

Quick answers

Is CVE-2026-42458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42458 being exploited in the wild.
How severe is CVE-2026-42458?: Medium severity, with a CVSS score of 4, published 15 May 2026.
Which products and versions are affected?: OpenMage < 20.18.0, <= 20.17.0; openmage/magento-lts (Packagist) <= 20.17.0, ECOSYSTEM:introduced=0,fixed=20.18.0.
Is there a fix for CVE-2026-42458?: Yes. openmage/magento-lts (Packagist): upgrade to 20.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42458 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42458?: Check whether you run OpenMage or openmage/magento-lts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openmage/magento-lts (Packagist): upgrade to 20.18.0 or later
```
composer require openmage/magento-lts:^20.18.0
```

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in OpenMage Magento LTS versions up to 20.17.0. The vulnerability is located in the 'Dataflow - Profiles' section of the admin panel (System -> Import/Export -> Dataflow - Profiles). The application fails to properly sanitize the 'files' parameter in the URL when running a profile, allowing an attacker to inject arbitrary HTML or JavaScript. While the path is within the admin panel, the vulnerability is reflected, meaning an attacker could potentially target an authenticated administrator via a crafted URL. Successful exploitation can lead to session hijacking or unauthorized administrative actions. The issue is fixed in version 20.18.0.

Affected products

OpenMage Magento LTS (OpenMage) <= 20.17.0

Identifiers

CVE-2026-42458
GHSA-x8jv-q8j2-487c

Timeline

2026-05-04: disclosed: Initial disclosure in OpenMage repository
2026-05-06: advisory: GitHub Advisory published
2026-05-15: patched: NVD publication and version 20.18.0 release confirmed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.