GHSA-fpxp-pfqm-x54wMediumCVSS 4.1

PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

Published
October 16, 2025
Last Modified
October 16, 2025

🔗 CVE IDs covered (1)

CVE-2025-61923 →

📋 Description

Impact

Missing validation on input vulnerable to directory traversal.

Patches

The problem has been patched in versions:

v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1) v4.4.1 for PrestaShop 8 (build number: 8.4.4.1) v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5) v5.0.5 for PrestaShop 8 (build number: 8.5.0.5) v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the Versioning policy to learn more about the build number.

Credits

Léo CUNÉAZ for reportied this issue.

🎯 Affected products2

  • composer/prestashop/ps_checkout:< 4.4.1
  • composer/prestashop/ps_checkout:>= 5.0.0, < 5.0.5

🔗 References (3)