Read the docs
TI-2023-14380 Aliases CVE-2023-30545GHSA-8r4m-5p6p-52rp

PrestaShop arbitrary file read vulnerability

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00863 58th percentileScored 2026-11-07
Fix Fixed PrestaShop (PrestaShop): 1.7.8.9, 8.0.4prestashop/prestashop (Packagist): 8.0.4, 1.7.8.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PrestaShopPrestaShopbefore 1.7.8.9; 8.0.0 to before 8.0.41.7.8.9, 8.0.4Patch availableCNA
—prestashop/prestashop (Packagist)8.0.0 to before 8.0.48.0.4Patch availableGHSA-8r4m-5p6p-52rp
—prestashop/prestashop (Packagist)before 1.7.8.91.7.8.9Patch availableGHSA-8r4m-5p6p-52rp
  • PrestaShop VendorPrestaShop Affected before 1.7.8.9; 8.0.0 to before 8.0.4 Fixed in 1.7.8.9, 8.0.4 Patch available CNA
  • prestashop/prestashop (Packagist) Vendor— Affected 8.0.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-8r4m-5p6p-52rp
  • prestashop/prestashop (Packagist) Vendor— Affected before 1.7.8.9 Fixed in 1.7.8.9 Patch available GHSA-8r4m-5p6p-52rp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*before 1.7.8.9; 8.0.0 to before 8.0.4VulnerablePrestaShop
  • cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* Versions before 1.7.8.9; 8.0.0 to before 8.0.4 Vulnerable ·PrestaShop

Remediation

  • Fix · CNA PrestaShop (PrestaShop) Fixed in 1.7.8.9, 8.0.4
  • Fix · GHSA-8r4m-5p6p-52rp prestashop/prestashop (Packagist) Fixed in 8.0.4 Advisory →
  • Fix · GHSA-8r4m-5p6p-52rp prestashop/prestashop (Packagist) Fixed in 1.7.8.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30545
  2. 2026-10-03 Alias added: GHSA-8r4m-5p6p-52rp

References

Patch 2

Advisory 2

Other 1

  • TI-2024-27717 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
  • TI-2024-23013 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload CVSS 3.1CRITICAL 9.7
  • TI-2018-06367 modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu… CVSS 3.0CRITICAL 9.8
  • TI-2025-19098 A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0… CVSS 3.1MEDIUM 6.5
  • TI-2018-13560 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2021-02206 The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the… CVSS 3.1CRITICAL 9.8
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences