PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (…

published 2015-04-29 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-1536

cvss: 6.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 9.7%; EPSS 9.7% chance of exploitation in 30 days, percentile 95%
public exploits: 0; none known

PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.

Patch / fix

links 1

magento.com/blog/technical/critical-security-advisory-remote-code-exec… advisory

Exploit prediction

9.74% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

blog.checkpoint.com http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

magento.com /blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability
patch, vendor-advisory
blog.checkpoint.com /2015/04/20/analyzing-magento-vulnerability/
exploit
securitytracker.com /id/1032194
vdb-entry

Sources

CVE List CVE-2015-1399
NVD CVE-2015-1399

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary