GHSA-jg68-vhv3-9r8f
Medium · 5.3CVSS
5.3
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
Magento's X-Original-Url header can expose admin url
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | openmage/magento-lts | 0 | 20.16.1 |
Related vulnerabilities
- CVE-2026-25523 Magento-lts is a long-term support alternative to Magento Community Edition (CE). Same vulnerability
- CVE-2025-64174 Magento-lts is a long-term support alternative to Magento Community Edition (CE). Also affects openmage/magento-lts
- GHSA-qv78-c8hc-438r OpenMage vulnerable to XSS in Admin Notifications Also affects openmage/magento-lts
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200