CVE-2026-124916

MEDIUM 5.4

PrestaShop Performance Debug Configuration PHP Code Injection

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.

Vendor	prestashop
Product	prestashop
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for prestashop prestashop

Be the first to know when new medium vulnerabilities affecting prestashop prestashop are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

PrestaShop / PrestaShop

1.5.0.0 < 9.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

prestashop.com: https://prestashop.com/ github.com: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q kb.cert.org: https://www.kb.cert.org/vuls/id/385711