What’s Vulnerable › Vulnerabilities

CVE-2024-26129: Prestashop vulnerable to path disclosure in JavaScript variable

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-19 · updated 2026-06-17
• Weakness: CWE-22

Description

PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.

Affected products

• PrestaShop: from 8.1.0 before 8.1.4 — fixed in 8.1.4

How to fix

Upgrade to a fixed version: PrestaShop 8.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr
• https://owasp.org/www-community/attacks/Full_Path_Disclosure
• https://github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr
• https://owasp.org/www-community/attacks/Full_Path_Disclosure

Get alerted when CVE-2024-26129 or the next vulnerability affects your stack