Medium severity · published May 15, 2026
CVE-2026-42207
Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
magento-lts · OpenMage
< 20.18.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42207
github.com
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-qpgq-5g92-j5q8
More from magento-lts
9.3
CVE-2026-42155
Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs
8.8
CVE-2026-40488
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
8.1
CVE-2026-25524
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
5.4
CVE-2026-40098
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
5.3
CVE-2026-42458
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)