PRESTASHOP · CVE-2026-124916 · Runtime
FIX → 9.2.1 ✓ verified
PrestaShop writes the debug cookie name and value from the Performance back-office settings into a PHP configuration file without enough escaping. When the file is loaded, injected PHP code runs with the web server's privileges.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
PrestaShop 9.0.0 to before 9.2.1 where an employee profile has Performance page permissions. Such an employee can inject PHP that runs on every request with the web server user's privileges, which is privilege escalation since that profile cannot normally install modules. Shops where only fully trusted admins have Performance access can skip it as lower risk.
Not affected if managed-hosting, no-untrusted-back-office-users
Who cares php, prestashop, self-hosted
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debug_cookie_name or debug_cookie_value that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 9.2.1
9.2.1