Description
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
Published: 2026-11-09
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Execution of arbitrary PHP code via debug configuration
Action: Apply Patch
AI Analysis

Impact

A back‑office user with permission to change Performance debug settings can submit a crafted debug cookie name or value that is written directly—without proper escaping—to a PHP configuration file. When PrestaShop loads this file, the injected code runs with web‑server privileges, allowing an attacker to execute arbitrary PHP code on the host. This constitutes full remote code execution on the affected installation.

Affected Systems

PrestaShop installations where the Performance debug mode is enabled and users with debug‑configuration privileges are present. Versions are unspecified, but all releases prior to a forthcoming patch are susceptible.

Risk and Exploitability

The flaw can be exploited by anyone with back‑office access; the attack vector is local authenticated. No CVSS score is provided in the advisory, and the EPSS is not available, but the vulnerability permits complete compromise of the server. It is not currently listed in the CISA KEV catalog.

Generated by OpenCVE AI on November 9, 2026 at 16:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest PrestaShop version that includes the official fix for the debug‑mode injection issue
  • If updating is not immediately possible, disable the Performance debug mode entirely to eliminate the vulnerable configuration pathway
  • Limit edit permissions for the debug‑settings configuration to the minimum necessary users to reduce the risk of accidental or malicious exploitation
  • Apply input sanitization or escaping to the debug_cookie_name and debug_cookie_value parameters if custom modifications are made
  • Verify that the configuration files for the debug mode contain no injected code before applying changes

Generated by OpenCVE AI on November 9, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
References

Mon, 09 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Prestashop
Prestashop prestashop
Weaknesses CWE-74
Vendors & Products Prestashop
Prestashop prestashop

Mon, 09 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Mon, 09 Nov 2026 15:00:00 +0000

Type Values Removed Values Added
Description PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
Title PrestaShop Performance Debug Configuration PHP Code Injection
References

Subscriptions

Prestashop Prestashop
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-11-09T17:05:22.664Z

Reserved: 2026-11-09T14:47:24.325Z

Link: CVE-2026-124916

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T15:17:19.227

Modified: 2026-11-09T17:17:27.847

Link: CVE-2026-124916

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T16:45:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')