The flaw occurs in PrestaShop’s Tools::getRemoteAddr() when run behind a reverse proxy, load balancer, or CDN. The function honours the X‑Forwarded‑For header without validation and treats the supplied address as the client IP. An unauthenticated remote attacker can inject any IP via this header, causing the application to believe the request originates from that address. This allows bypass of maintenance‑mode allowlists, forge audit logs, and evade third‑party controls such as geolocation checks, fraud detection, or request throttling.

PrestaShop applications running versions prior to 9.1.5 and 8.2.8 are vulnerable. The issue affects the core PrestaShop product regardless of deployment architecture when the reverse‑proxy header is trusted.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available and it is not listed in CISA KEV. Externally, the attack can be conducted from any network that can reach the web application, provided the attacker can influence the X‑Forwarded‑For header. Because the vulnerability does not require authentication or privilege, exploitation is straightforward once the proxy mis‑configuration exists, and the attack surface is the reverse‑proxy configuration rather than the application itself.