What’s Vulnerable › Vulnerabilities

CVE-2022-21686: Server Side Twig Template Injection in PrestaShop

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-26 · updated 2026-06-17
• Weakness: CWE-94

Description

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

Affected products

• PrestaShop: from 1.7.0.0 through 1.7.8.3

References

• https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.3
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465
• https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.3
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465

Get alerted when CVE-2022-21686 or the next vulnerability affects your stack