Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2023-39528

PrestaShop vulnerable to file reading through path traversal

Description

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PrestaShop PrestaShop

  • < 8.1.1affected

References