The vulnerability in the ps_facetedsearch module is a PHP Object Injection flaw that originates from the module’s handling of filter values supplied through the request URL. Without proper validation, these values are stored in a cached block serialized with PHP’s native serialize, and later deserialized with unserialize. An attacker can craft a serialized PHP object that, when deserialized, triggers a gadget chain to write an arbitrary PHP file into the modules/ps_facetedsearch/ directory, effectively creating a webshell that could run any command on the server. This flaw allows an unauthenticated user to gain full remote code execution on a vulnerable installation.

Affected versions of the PrestaShop ps_facetedsearch module from 3.0.0 through 4.0.4. Any shop that has installed the module in those versions and has not yet applied the fix is at risk. The product is specifically the PrestaShop ps_facetedsearch module, which provides layered navigation filters for the e‑commerce platform.

The CVSS score of 10 indicates a high severity, and the flaw permits remote actions with no authentication or privileges. Although the EPSS score is listed as < 1 %, suggesting a currently low probability of exploitation, the inherent risk of high impact remains unchanged. The likely attack vector is via a crafted URL supplied to the shop’s public web interface; the payload is then stored in the module’s internal cache and deserialized during subsequent requests. Because the vulnerability allows arbitrary file creation and execution, the threat to confidentiality, integrity, and availability is complete and direct.