Read the docs
TI-2026-39069 Aliases CVE-2026-54159GHSA-m5f5-28qr-9g9r

ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

Priority MEDIUM 50CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize() in src/Filters/Block.php. By crafting that value, an unauthenticated attacker can smuggle a malicious serialized PHP object into the cache, and when it is deserialized, a gadget chain writes an arbitrary PHP file inside the modules/ps_facetedsearch/ directory, which is then used as a webshell to run commands on the server. This issue is fixed in version 4.0.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0075 55th percentileScored 2026-11-07
Fix Fixed ps_facetedsearch (PrestaShop): 4.0.4prestashop/ps_facetedsearch (Packagist): 4.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PrestaShopps_facetedsearch3.0.0 to before 4.0.44.0.4Patch availableCNA
—prestashop/ps_facetedsearch (Packagist)3.0.0 to before 4.0.44.0.4Patch availableGHSA-m5f5-28qr-9g9r
  • ps_facetedsearch VendorPrestaShop Affected 3.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available CNA
  • prestashop/ps_facetedsearch (Packagist) Vendor— Affected 3.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-m5f5-28qr-9g9r

Remediation

  • Fix · CNA ps_facetedsearch (PrestaShop) Fixed in 4.0.4
  • Fix · GHSA-m5f5-28qr-9g9r prestashop/ps_facetedsearch (Packagist) Fixed in 4.0.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54159
  2. 2026-10-03 Alias added: GHSA-m5f5-28qr-9g9r

References

Other 4

  • TI-2024-27717 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
  • TI-2023-14167 Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook(). CVSS 3.1CRITICAL 9.8
  • TI-2023-14166 Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). CVSS 3.1CRITICAL 9.8
  • TI-2023-10662 PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. CVSS 3.1CRITICAL 9.8
  • TI-2024-23013 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload CVSS 3.1CRITICAL 9.7
  • TI-2023-14154 An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in… CVSS 3.1CRITICAL 9.8
See all 133 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences