PrestaShop debug mode allows PHP injection (CVE-2026-124916)
A back-office user who can edit debug settings can inject PHP; 9.2.1 fixes it, but affected releases are unconfirmed.
48
CVE-2026-124916
Authenticated PHP injection in PrestaShop debug config
- CVSS 3.1
- 5.4 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
PrestaShop's back-office Performance debug-mode settings write `debug_cookie_name` or `debug_cookie_value` into a PHP configuration file without sufficient escaping. A back-office user who can change those debug settings can inject PHP that runs with the web-server process's privileges when PrestaShop later loads the file. Affected PrestaShop builds and fixed releases are not stated.
What to do: Apply PrestaShop's update for CVE-2026-124916. No workaround is named.
| Product | Affected |
|---|---|
| PrestaShop | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
- Ecosystems
- E-commerce
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N