GHSA-283w-xf3q-788v CVE-2026-33674
PrestaShop: Improper Use of Validation Framework
- Severity
- 2.0 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.25%
- Chance of exploitation in the next 30 days. Higher than 15.96% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1173 Improper Use of Validation Framework
- Fix
8.2.5- Upgrade prestashop/prestashop to this version or later
Description
Impact
Fix improper use of validation framework
Patches
Patched in 8.2.5 and 9.1.0
Workarounds
None
References
none
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| prestashop/prestashop | < 8.2.5 |
8.2.5 |
| prestashop/prestashop | >= 9.0.0-alpha.1, < 9.1.0 |
9.1.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
prestashop/prestashop Packagist → 8.2.5
- composer
composer require prestashop/prestashop:^8.2.5
Severity breakdown
CVSS 3.1 2.0
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-1173: Improper Use of Validation Framework
The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.
How to prevent it
- Implementation: Properly use provided input validation frameworks.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-w9f3-qc75-qgx9 PrestaShop has a stored XSS executable in customer service view | Critical | Also affects prestashop/prestashop |
| GHSA-35pf-37c6-jxjv PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables | Medium | Also affects prestashop/prestashop |
| GHSA-67v7-3g49-mxh2 PrestaShop affected by time based enumeration in FO login form | Medium | Also affects prestashop/prestashop |
| GHSA-8xx5-h6m3-jr33 Presta Shop vulnerable to email enumeration | Low | Also affects prestashop/prestashop |
| GHSA-7pjr-2rgh-fc5g Anonymous PrestaShop customer can download other customers' invoices | Medium | Also affects prestashop/prestashop |
| GHSA-45vm-3j38-7p78 PrestaShop cross-site scripting via customer contact form in FO, through file upload | Medium | Also affects prestashop/prestashop |
| GHSA-3366-9287-7qpr Path disclosure in JavaScript variable | Medium | Also affects prestashop/prestashop |
| GHSA-vr7m-r9vm-m4wf PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO) | Medium | Also affects prestashop/prestashop |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor