CVE-2015-1399

Exploitation likely. EPSS gives it a 9.7% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 2.06.5Medium EPSS percentile95th9.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2015-04-29Updated 2026-05-06Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check if your store runs Magento Community Edition 1.9.1.0 or Enterprise Edition 1.14.1.0 — ask your developer or hosting provider.
Review who has admin access to your Magento dashboard and remove any accounts you don't recognize or no longer need.
Apply Magento's official security patch described in their advisory (search 'Magento critical security advisory RCE' or check the link your developer has).
After patching, confirm with your developer that the fetchView/template processing fix is in place and test the admin panel still works normally.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.

In plain language

Written by AI from the record

This is an old Magento online-store bug that lets someone who already has an admin login run their own code on your server; it needs an admin account to pull off, so most stores aren't at urgent risk, but store owners on this old version should still update.

Authenticated remote file inclusion in Mage_Core_Block_Template_Zend's fetchView/setScriptPath allows a logged-in Magento admin to point template processing at an attacker-controlled URL, resulting in arbitrary PHP code execution on the server.

If you're affected

Full store server takeover
Customer data exposure
Payment data exposure
Operational disruption

What is it

Think of this like a store manager who has the keys to the back office being able to trick the system into running an unauthorized program instead of the normal one. In Magento, a feature that loads page templates can be pointed at a malicious file instead, letting that admin's actions run code the store owner never approved. It only works if someone already has an admin-level login, so it's not something a random stranger on the internet can trigger directly.

Who is affected

This matters to you if you run Magento Community Edition version 1.9.1.0 or Enterprise Edition version 1.14.1.0 for your online store. It only becomes a real risk if someone has (or obtains) a valid admin account on your Magento backend — it's not exploitable by an anonymous visitor.

How urgent is it

There are no reports of attackers using this in real attacks, and no public exploit code exists for it, so this is not an active emergency. Because it also requires an attacker to already have admin credentials, the practical risk for a typical store is low. You should still plan to apply the vendor's fix during normal maintenance, but there is no need to treat it as urgent.

What to do — in detail

Confirm your Magento deployment version — vulnerable versions are CE 1.9.1.0 and EE 1.14.1.0. Review admin account hygiene first: audit all admin users, enforce strong unique passwords and two-factor authentication where supported, and remove stale accounts, since exploitation requires admin-level access. Apply the official vendor patch referenced in Magento's critical security advisory for this RCE issue; follow Magento's upgrade/patch instructions for your specific edition and version branch, testing in staging before production due to possible breaking changes in template handling. If immediate patching isn't possible, as a temporary mitigation restrict admin panel access by IP allowlisting or VPN, and tighten who can access the admin dashboard. No CISA KEV deadline applies since this CVE is not currently listed in KEV. Monitor admin account activity logs for unexpected template/script path changes as an ongoing precaution.

Technical context

CVSS 6.5 (Medium), vector AV:N/AC:L/Au:S/C:P/I:P/A:P — network-exploitable but requires single-factor (admin) authentication, with partial confidentiality, integrity, and availability impact. Weakness type is CWE-94 (Code Injection), via remote file inclusion in the fetchView function of Mage_Core_Block_Template_Zend, triggered through setScriptPath accepting an attacker-supplied URL. Not listed in CISA KEV; no public exploit code found; EPSS places it in the 95th percentile with a rising trend, indicating elevated predicted interest despite no confirmed in-the-wild exploitation. Exploit maturity is effectively theoretical/PoC-absent at this time; note the vendor's own ambiguity that admins may already have equivalent file-include privileges, which somewhat limits the real privilege-escalation value of this flaw.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.