CVE-2026-14846

The Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

In the "Rotator Img" module (posrotatorimg) for PrestaShop in versions at least up to 1.1 from PosThemes, an unauthenticated user can perform an SQL injection attack.

PrestaShop is an open source e-commerce application that is vulnerable to remote code execution through SQL injection and arbitrary file write in the back office in versions prior to 1.7.8.10, 8.0.5, and 8.1.1.

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address.

PrestaShop module totadministrativemandate versions below 1.8.1 are vulnerable to Cross-Site Request Forgery (CSRF). The payment validation controller lacks a CSRF token, allowing an attacker to confirm an order in awaiting status by hijacking a link.

A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

A PHAR deserialization vulnerability in the /themes/import component of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

PrestaShop prior to version 8.1.1 allows for file deletion from the server using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue.

PrestaShop prior to version 8.1.1 contained the `displayAjaxEmailHTML` method that could be exploited to read any file on the server, potentially even outside of the project if the server is not correctly configured.

PrestaShop, as an open-source e-commerce application, is vulnerable to cross-site scripting (XSS) attacks through the `isCleanHTML` method in versions prior to 1.7.8.10, 8.0.5, and 8.1.1. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch.