Most recent entries from all

EUVD-2026-255271

fkie_cve-2025-61923

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

GHSA-fpxp-pfqm-x54w — PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

Affected: Packagist: prestashop/ps_checkout

# Impact Missing validation on input vulnerable to directory traversal.

# Patches The problem has been patched in versions:

v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1) v4.4.1 for PrestaShop 8 (build number: 8.4.4.1) v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5) v5.0.5 for PrestaShop 8 (build number: 8.5.0.5) v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.

# Credits [Léo CUNÉAZ](https://github.com/inem0o) for reportied this issue.