# CVE-2026-42458: OpenMage Magento LTS reflected XSS in Dataflow Profiles

Source: https://junglewise.ai/threats/cve-2026-42458-openmage-magento-lts-reflected-xss-in-dataflow-profiles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-42458 · Severity: medium · CVSS 4 · Published 2026-05-15

A security vulnerability exists in the administrative interface of OpenMage Magento LTS, an e-commerce platform. An attacker could trick an administrator into clicking a malicious link, allowing the attacker to execute unauthorized scripts in the administrator's browser. This could lead to the theft of sensitive session cookies, account takeover, or unauthorized changes to the store's configuration.

Technologies: [OpenMage](https://junglewise.ai/threats/technologies/openmage), [openmage/magento-lts (Packagist)](https://junglewise.ai/threats/technologies/openmage-magento-lts). Vendors: [OpenMage](https://junglewise.ai/threats/vendors/openmage), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42458 being exploited in the wild.

**How severe is CVE-2026-42458?** Medium severity, with a CVSS score of 4, published 15 May 2026.

**Which products and versions are affected?** OpenMage < 20.18.0, <= 20.17.0; openmage/magento-lts (Packagist) <= 20.17.0, ECOSYSTEM:introduced=0,fixed=20.18.0.

**Is there a fix for CVE-2026-42458?** Yes. openmage/magento-lts (Packagist): upgrade to 20.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42458 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42458?** Check whether you run OpenMage or openmage/magento-lts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openmage/magento-lts (Packagist): upgrade to 20.18.0 or later

  ```sh
  composer require openmage/magento-lts:^20.18.0
  ```


## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in OpenMage Magento LTS versions up to 20.17.0. The vulnerability is located in the 'Dataflow - Profiles' section of the admin panel (System -> Import/Export -> Dataflow - Profiles). The application fails to properly sanitize the 'files' parameter in the URL when running a profile, allowing an attacker to inject arbitrary HTML or JavaScript. While the path is within the admin panel, the vulnerability is reflected, meaning an attacker could potentially target an authenticated administrator via a crafted URL. Successful exploitation can lead to session hijacking or unauthorized administrative actions. The issue is fixed in version 20.18.0.

## Affected products

- OpenMage Magento LTS (OpenMage) <= 20.17.0

## Identifiers

- CVE-2026-42458
- GHSA-x8jv-q8j2-487c

## Timeline

- 2026-05-04: disclosed: Initial disclosure in OpenMage repository
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-15: patched: NVD publication and version 20.18.0 release confirmed

## References

- [https://api.github.com/users/justlife4x4](https://api.github.com/users/justlife4x4)
- [https://github.com/justlife4x4](https://github.com/justlife4x4)
- [https://api.github.com/users/justlife4x4/gists%7B/gist_id%7D](https://api.github.com/users/justlife4x4/gists%7B/gist_id%7D)
- [https://api.github.com/users/justlife4x4/repos](https://api.github.com/users/justlife4x4/repos)
- [https://avatars.githubusercontent.com/u/59994040?v=4](https://avatars.githubusercontent.com/u/59994040?v=4)
- [https://api.github.com/users/justlife4x4/events%7B/privacy%7D](https://api.github.com/users/justlife4x4/events%7B/privacy%7D)

## Related threats

- [OpenMage Magento LTS open redirect in stockAction controller](https://junglewise.ai/threats/cve-2026-42207-openmage-magento-lts-open-redirect-in-stockaction-controller)
- [OpenMage Magento LTS predictable API session ID generation](https://junglewise.ai/threats/cve-2026-42155-openmage-magento-lts-predictable-api-session-id-generation)
- [OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution](https://junglewise.ai/threats/cve-2026-40488-openmage-lts-customer-file-upload-extension-blocklist-bypass)
- [OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure](https://junglewise.ai/threats/cve-2026-40098-openmage-lts-cross-user-wishlist-import-leads-to-private-option)
- [OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module](https://junglewise.ai/threats/cve-2026-25525-openmage-lts-has-a-path-traversal-filter-bypass-in-dataflow)