Technical impact
PrestaShop applications running versions older than 8.2.5 and 9.1.0 improperly use the validation framework, allowing crafted input to bypass normal checks. The likely attack vector involves submitting malicious data via web forms or API calls; this could result in unintended data disclosure or injection. The vulnerability is classified as CWE‑1173 "Improper Validation of Data".
Affected Systems
All installations of PrestaShop certified as "PrestaShop" that are running any version preceding 8.2.5 or 9.1.0 are affected. This includes both community‑edited and commerce stores that rely on the default validation components shipped with those releases.
Risk and Exploitability
The CVSS score of 2 indicates low severity, and the EPSS score is reported as below 1%, suggesting that exploitation over the internet is unlikely at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, reinforcing that no active exploits are known. Exploitation would require successful injection of malformed input that bypasses validation, but no public proof‑of‑concept or exploit has been disclosed.
Github GHSA