CVE-2023-39526: PrestaShopSQL manager vulnerability (potential RCE)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-07 · updated 2026-06-17
Weakness: CWE-89

Description

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

Affected products

PrestaShop: before 1.7.8.10; from 8.0.0 before 8.0.5; 8.1.0 — fixed in 1.7.8.10, 8.0.5

How to fix

Upgrade to a fixed version: PrestaShop 1.7.8.10, 8.0.5. Check the vendor advisory for mitigations.

References

https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc
https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc

Get alerted when CVE-2023-39526 or the next vulnerability affects your stack