CVE-2025-61923
MediumCVSS 4.1Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 lack input validation in the backoffice, resulting in directory traversal and arbitrary file disclosure. Fixed in versions 4.4.1 and 5.0.5.
Risk Assessment
An attacker can read arbitrary files on the server, potentially leading to disclosure of sensitive data such as configuration or keys.
Recommendation
Update the PrestaShop Checkout module to version 4.4.1 or 5.0.5.
Other vulnerabilities in PrestaShop Checkout
See all- CVE-2025-61922Critical
PrestaShop Checkout versions starting from 1.3.0 and prior to 4.4.1 and 5.0.5 have missing validation on the Express Checkout feature, allowing silent login and account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
- CVE-2025-61924Low
PrestaShop Checkout (versions prior to 4.4.1 and 5.0.5) contains a vulnerability allowing hijacking of the target PayPal merchant account from the backoffice due to incorrect usage of the PHP array_search() function. The flaw is fixed in versions 4.4.1 and 5.0.5.
Original NVD description (English source)
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS