CVE-2023-39525
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
PrestaShop prior to version 8.1.1 has a vulnerability in the back office that allows file compromise through a path traversal attack. This can be achieved by replaying the import file deletion query with a specified file path that exploits this vulnerability.
Risk Assessment
Organizations using PrestaShop may be exposed to unauthorized file access, potentially leading to data loss or privacy breaches.
Recommendation
It is recommended to upgrade to version 8.1.1 or later to patch this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.