CVE-2025-25691

MediumCVSS 6.5

Published: 30/07/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

52th percentile - higher than 52% of all known CVEs

Summary

A PHAR deserialization vulnerability in the /themes/import component of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

Risk Assessment

An attacker can take over the server, steal customer data, or install malware, leading to a breach of system integrity and confidentiality.

Recommendation

Immediately update PrestaShop to the latest version and apply available security patches. Additionally, restrict access to the /themes/import endpoint to trusted users only.

Original NVD description (English source)

A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.