CVE-2026-54159
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The ps_facetedsearch module for PrestaShop from version 3.0.0 to 4.0.4 (before 4.0.4) contains a deserialization vulnerability. The module rebuilds selected search filters from the request URL, and the value of a slider filter (price or weight) is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw unserialize(). An unauthenticated attacker can smuggle a malicious serialized PHP object into the cache, and when deserialized, a gadget chain writes an arbitrary PHP file inside the module's directory, which is then used as a webshell to run commands on the server.
Risk Assessment
An attacker can remotely execute arbitrary commands on the PrestaShop server, leading to full compromise of the store, customer data theft, and takeover of the e-commerce platform.
Recommendation
Update the ps_facetedsearch module to version 4.0.4 or later, which fixes this vulnerability.
Original NVD description (English source)
PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize() in src/Filters/Block.php. By crafting that value, an unauthenticated attacker can smuggle a malicious serialized PHP object into the cache, and when it is deserialized, a gadget chain writes an arbitrary PHP file inside the modules/ps_facetedsearch/ directory, which is then used as a webshell to run commands on the server. This issue is fixed in version 4.0.4.