PrestaShop debug mode allows PHP injection (CVE-2026-124916)
Original title: VU#385711: PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability
A back-office user who can edit debug settings can inject PHP; 9.2.1 fixes it, but affected releases are unconfirmed.
CERT/CC says PrestaShop writes unsanitized debug cookie name and value into a PHP define() statement in config/defines.inc.php or config/defines_custom.inc.php. An authenticated back-office account allowed to change Debug mode can inject code that runs as the PHP process on a later request. Version 9.2.1 addresses the flaw. Affected release versions remain unconfirmed, and no exploitation is described.
Unconfirmed: Affected release versions remain to be confirmed.
- The attacker needs debug-mode permission and a config file writable by PHP.
- CSRF controls do not stop someone who already controls such an account.
- Injected code does not by itself grant root privileges.
- Reported by Deflask13; the note was first published on November 9.
Impact: arbitrary PHP execution as the PHP process
| Product | Affected | Fixed in |
|---|---|---|
| PrestaShop | — | 9.2.1 |
- 1.Upgrade affected PrestaShop installations to version 9.2.1 or later.
- 2.Allow only trusted administrators to change Performance and Debug mode settings.
- 3.Where feasible, stop PHP from writing the defines configuration files.
- CVEs
- CVE-2026-124916
- Vendors
- PrestaShop
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-124916 | Authenticated PHP injection in PrestaShop debug config | 5.4 | — |
From the original article
2 min read at kb.cert.orgOverview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration file. Successful exploitation could allow arbitrary code execution with the privileges of the PHP process.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.