CVE-2022-46158: Potential Information exposure in the upload directory in PrestaShop

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-08 · updated 2026-06-17
Weakness: CWE-200

Description

PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.

Affected products

PrestaShop: before 1.7.8.8 — fixed in 1.7.8.8

How to fix

Upgrade to a fixed version: PrestaShop 1.7.8.8. Check the vendor advisory for mitigations.

References

https://github.com/PrestaShop/PrestaShop/commit/8684d429fb7c3bb51efb098e8b92a1fd2958f8cf
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-9qgp-9wwc-v29r
https://github.com/PrestaShop/PrestaShop/commit/8684d429fb7c3bb51efb098e8b92a1fd2958f8cf
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-9qgp-9wwc-v29r

Get alerted when CVE-2022-46158 or the next vulnerability affects your stack