CVE-2019-8126: Magento

Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days.

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.

Affected products

• Magento Magento: from 2.2.0, before 2.2.10 (fixed in 2.2.10); from 2.3.0, before 2.3.2 (fixed in 2.3.2); version 2.3.2 only

Published 2019-11-05. Last modified 2026-06-17.