3.3.0

Released: 2026-08-05
Upstream: Magento Open Source 2.4.9

Mage-OS 3.3.0 is a security release. It fixes a critical vulnerability in the bundled PageBuilder template import/export module, and ships a substantial round of PHP 8.5 compatibility work, Redis cache correctness fixes, and dependency-injection fixes.

All users running Mage-OS 3.x should upgrade, and anyone whose administrators have access to the Page Builder template import/export features should treat it as urgent.

composer require mage-os/product-community-edition 3.3.0 --no-update
composer update

---

Security

Remote code execution via PageBuilder template import (GHSA-hrj3-88v2-6wjx)

The security issues in this release are isolated to the mage-os/module-page-builder-template-import-export package. Exploitation requires admin access to the Page Builder import/export features, but is critical for anyone that has that access.

The template import endpoint accepted arbitrary file types and copied archive contents into pub/media without validating entry paths or file contents, which allowed an administrator with template import access to write executable content into a web-served directory. Archive entry paths were not checked for traversal, and the export side could be pointed at files outside pub/media.

Severity: critical. CWE-434, CWE-22. CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L.
Fixed in mage-os/module-page-builder-template-import-export 1.9.0, which 3.3.0 bundles.

The fix hardens both sides of the feature:

• Import is restricted to .zip uploads. Template assets are limited to gallery image types
  (jpg, jpeg, png, gif, webp) and re-encoded through the image adapter, so appended data,
  EXIF-embedded payloads and polyglot files do not survive import.
• Archive entries containing .., absolute paths, drive-letter prefixes or NUL bytes are rejected
  before extraction, and archive entry count and total uncompressed size are capped.
• Symbolic links in template assets are skipped, and the import sub-path supplied by remote
  (Dropbox) imports is validated before use.
• Export only includes assets and preview images that resolve inside pub/media, verified with
  realpath() so symlinked entries cannot escape the media root.
• Each import extracts into a unique temporary directory, and the uploaded archive and extraction
  directory are removed once the import completes or fails.

Mitigation

If you cannot upgrade immediately, any of the following will close the issue:

1. Update to Mage-OS 3.3.0 (recommended).
2. Update just this package to 1.9.0. Mage-OS 3.0.0 through 3.2.0 pin it at exactly 1.8.1, so
   an inline alias is required:

   composer require mage-os/module-page-builder-template-import-export:"1.9.0 as 1.8.1"

3. Disable the module in app/etc/config.php until you are able to upgrade:

   'MageOS_PageBuilderTemplateImportExport' => 0

Note: options 1 and 2 both bring in behavior changes in the module — most importantly, templates whose assets are not images no longer import. See Upgrade notes below before choosing between upgrading and disabling.

---

Fixes

PHP 8.5 compatibility

Several of these fixes originate from pull requests that are still open against magento/magento2. Mage-OS has cherry-picked them so that users get them now rather than waiting on upstream review; original authorship is preserved on every commit.

• Tax rates with more than one store view no longer raise a deprecation error when edited.
  (Pieter Hoste — upstream magento/magento2#41026)
• Category attributes with a null frontend_input no longer trigger a null array-offset
  deprecation. (#302, #312 — Pieter Hoste, Ryan Hoerr — upstream
  magento/magento2#40894)
• Last visited category ID is null-checked before use. (#314 — Kostadin Bashev, Ryan Hoerr —
  upstream magento/magento2#40890)
• KEY_MYSQL_SSL_VERIFY, previously hardcoded as 1014, no longer collides with the renamed
  Pdo\Mysql constant. (#313 — @shlrkb — upstream
  magento/magento2#40849)
• ScopeCodeResolver::resolve() no longer performs a null array offset. (#306, #311 — Ryan Hoerr)
• Captcha getCaptcha() no longer passes null to array_key_exists() when no form ID is set.
  (#297 — Ryan Hoerr)
• Null element ID in form rendering. (#307, #310 — Ryan Hoerr)

Cache and Redis

• Redis cache tag-bookkeeping leak. Tag sets in the Symfony-based cache adapter accumulated
  stale members that were never reclaimed, growing unbounded over time. Tag sets are now swept on
  invalidation, TagAdapterInterface::onSave() declares a lifetime, garbage collection runs against
  a time budget, and existence checks are batched through pipelined EXISTS. The Lua cleaners were
  corrected for key naming, bookkeeping cleanup and argument passing. Generic and filesystem
  adapters keep their upstream signatures so subclasses remain compatible. (#283, #298 — Ryan Hoerr)
• Redis unix socket connections now work in SymfonyAdapterProvider. (#294 — Ryan Hoerr)

Dependency injection

• setup:di:compile truncated plugin lists for every area except the first, producing
  incomplete compiled interception configuration. (#299, #301 — Paul Hachmang)
• PHP 8.4 lazy-ghost eligibility is now an opt-in allow-list rather than a deny-list, so classes
  are only given lazy proxies where that has been verified as safe. (#280, #293 — Ryan Hoerr)

Other

• AMQP consumers no longer busy-wait at 100% CPU — the wait timeout is passed as 0 rather than
  null. (#292 — Jeanmarcos)
• underscore.js upgraded to 1.13.8 to address a known vulnerability in the bundled library.
  Backported from upstream. (#309 — Bhavin Parmar, Adobe)
• Review structured data now emits the review author as a schema.org/Person object rather than
  a bare string. (#296 — Tu Van)

---

Bundled add-on updates

• mage-os/module-page-builder-template-import-export 1.8.1 → 1.9.0 — the security fix described
  above, plus the behavior changes noted under Upgrade notes. (Volker Dusch, Ryan Hoerr,
  Marcel Martinez)
• mage-os/module-rma 2.4.0 → 2.4.1 — supports PHP 8.2 and declares an open Magento
  compatibility range; API interfaces and search-result PHPDocs use fully-qualified class names so
  Swagger generation works. (#47, #49 — Marcel Martinez, Christian Stoller,
  Alexandru-Manuel Carabus)
• mage-os/module-admin-activity-log 2.0.1 → 2.0.2 — removes unused setConfig calls in
  ThemeConfig and SystemConfig. (#32 — Luca Fuser)
• swissup/module-ignition 1.3.1 → 1.3.2 — (Vova Yatsyuk)

---

Upgrade notes

Mage-OS 3.3.0 tracks the same upstream release as 3.2.0 (Magento Open Source 2.4.9). There are no added or removed dependencies, and no changes to magento2-base or project-community-edition beyond version bumps, so the upgrade from 3.2.0 is low-friction.

Two things to be aware of:

PageBuilder template import is stricter. The security fix changes behavior in three ways:

1. Templates containing assets that are not images no longer import — only jpg, jpeg, png,
   gif and webp assets are accepted. Templates previously exported with other asset types (SVG,
   for example) need to be re-exported before they can be imported.
2. TemplateManagement::storePreviewImage() throws a LocalizedException when a preview image
   cannot be processed, instead of returning null.
3. CmsConverter::__construct() takes an additional PathValidator argument, and
   TemplateManagement::__construct() takes additional PathValidator and LoggerInterface
   arguments. Classes that extend either and call parent::__construct() positionally need updating.

Redis cache bookkeeping changed. The tag-bookkeeping fix changes how tag sets are stored and reclaimed. No action is required, but if you run Redis cache with a large tag set, expect garbage collection activity as stale members are swept for the first time.

---

Security research credit

The PageBuilder template import vulnerability was found and reported to us by Volker Dusch (@edorian), Ecosystem AI Security Engineer in Residence at The PHP Foundation, as part of its Ecosystem Security efforts — funded by an Alpha-Omega grant and managed together with the OpenSSF.

We're glad to be part of this work. A safer PHP ecosystem benefits everyone building on it.

---

Contributors

Thanks to everyone who contributed to this release:

Kostadin Bashev, Alexandru-Manuel Carabus, Volker Dusch, Luca Fuser, Paul Hachmang, Ryan Hoerr, Pieter Hoste, Jeanmarcos, Marcel Martinez, Bhavin Parmar, Christian Stoller, Tu Van, Vova Yatsyuk, @shlrkb