SB2026081862 - Multiple vulnerabilities in PrestaShop

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081862

SB2026081862 - Multiple vulnerabilities in PrestaShop

Published: August 18, 2026

Security Bulletin ID SB2026081862
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to improper restriction of outbound requests in the back-office CSV import feature when processing image URLs from imported CSV files. A remote privileged user can supply a crafted CSV file with attacker-controlled image addresses to perform server-side request forgery.

The issue affects product imports and requires use of the back-office import feature.


2) Use of Less Trusted Source (CVE-ID: N/A)

CWE-ID: CWE-348 - Use of Less Trusted Source

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass access controls and spoof the client IP address.

The vulnerability exists due to use of a less trusted source in X-Forwarded-For header handling when processing requests forwarded through a reverse proxy, load balancer, or CDN. A remote attacker can supply a forged X-Forwarded-For header value to bypass access controls and spoof the client IP address.

Only deployments behind a reverse proxy, load balancer, or CDN are affected; shops where visitors connect directly to the web server are not affected.


3) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to sql injection in back-office list filters when processing crafted filter names in back-office listings. A remote privileged user can send a crafted filter name to disclose sensitive information.

The issue was demonstrated with the most restricted built-in employee profile, indicating the permission system does not contain access to the exposed database content.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose customer and order information.

The vulnerability exists due to improper access control in the back-office notifications endpoint when handling requests for notification panel data. A remote user can send a request with a valid back-office session to disclose customer and order information.

The issue affects employee accounts whose profiles grant no permission at all, and anonymous visitors are not affected.


5) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: N/A)

CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

CVSSv4: 7.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary formulas in a spreadsheet application.

The vulnerability exists due to improper neutralization of formula elements in a CSV file in CSV export files when opening exported CSV data in a spreadsheet application. A remote user can inject values beginning with formula characters into exported fields to execute arbitrary formulas in a spreadsheet application.

User interaction is required to open the exported CSV file in a spreadsheet application.


Remediation

Install update from vendor's website.

References