{"id":"CVE-2026-124916","kind":"vulnerability","aliases":["CVE-2026-124916"],"related":[],"title":"PrestaShop: back-office debug settings let an admin run PHP code","description":"PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.","summary":"PrestaShop writes the debug cookie name and value from the Performance back-office settings into a PHP configuration file without enough escaping. When the file is loaded, injected PHP code runs with the web server's privileges.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"prestashop","fixed":["9.2.1"],"affected":">= 9.0.0, < 9.2.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["php","prestashop","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-untrusted-back-office-users"],"how_to_check":"- Check the PrestaShop version in the back office; versions 9.0.0 up to but not including 9.2.1 are affected.\n- Review which back-office profiles hold Performance page permissions.\n- Inspect the debug cookie name and value saved in the Performance page for PHP code, and check the generated PHP file that stores them for unexpected code.","fix":"Upgrade PrestaShop to 9.2.1. Workaround: limit Performance page access to profiles already trusted with code execution on the server.","status":"open","published_at":"2026-11-09T15:17:19+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","triaged_at":"2026-11-09T15:28:13+00:00","updated_at":"2026-11-09T15:29:20+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-09T15:28:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PrestaShop: back-office debug settings let an admin run PHP code","impact":"high","summary":"PrestaShop writes the debug cookie name and value from the Performance back-office settings into a PHP configuration file without enough escaping. When the file is loaded, injected PHP code runs with the web server's privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["prestashop","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs as the web server user on the shop server.","analyst_note":"Find the affected and fixed PrestaShop versions in the vendor advisory (github.com advisory linked from the NVD entry) and confirm the fix.","how_to_check":"- Check the PrestaShop version in the back office or in the shop's `composer.json` or `config/settings.inc.php` files.\n- Look for a generated PHP file in the shop tree that contains the debug cookie settings and check whether its values contain code.\n- unknown for the exact affected version range; the sources do not state it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-back-office-users","managed-hosting"],"who_is_affected":"Shops running PrestaShop where back-office users can change Performance debug settings. The attacker needs a back-office account with permission to modify debug settings, so shops that restrict back-office permissions and have no untrusted staff are lower risk. The sources do not name affected versions or the fixed release.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4606,"output_tokens":586,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed PrestaShop versions in the vendor advisory (github.com advisory linked from the NVD entry) and confirm the fix.","search":"'-124916':15A,18A '-2026':14A,17A 'admin':9A 'authent':67C 'back':3A,38B,75C,84C 'back-offic':2A,37B,74C,83C 'code':12A,56B,69C,125C 'configur':44B,81C,113C 'contain':65C 'cooki':30B,98C,102C 'craft':96C 'cve':13A,16A 'debug':5A,29B,79C,91C,97C,101C 'debug-mod':78C 'enough':47B 'escap':48B,109C 'execut':127C 'file':45B,51B,114C,121C 'generat':120C 'host':25B 'inject':54B,70C,123C 'let':7A 'load':53B,118C 'mode':80C 'modifi':90C 'name':31B,99C 'offic':4A,39B,76C,85C 'perform':36B,77C 'permiss':88C 'php':11A,20B,43B,55B,68C,112C,124C 'prestashop':1A,19A,21B,26B,64C,116C 'privileg':63B,130C 'process':136C 'run':10A,57B 'runtim':22B 'self':24B 'self-host':23B 'server':61B,135C 'set':6A,40B,92C 'subsequ':117C 'suffici':108C 'suppli':94C 'user':86C 'valu':33B,103C 'vulner':71C 'web':60B,134C 'web-serv':133C 'without':46B,107C 'write':27B 'written':106C","nicknames":[],"mitigations":[],"who_affected":"PrestaShop 9.0.0 to before 9.2.1 where an employee profile has Performance page permissions. Such an employee can inject PHP that runs on every request with the web server user's privileges, which is privilege escalation since that profile cannot normally install modules. Shops where only fully trusted admins have Performance access can skip it as lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-09T15:29:20Z","by":"analyst","doc":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q","run_id":2298},"products":{"at":"2026-11-09T15:29:20Z","by":"analyst","doc":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q","run_id":2298},"how_to_check":{"at":"2026-11-09T15:29:20Z","by":"analyst","doc":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q","run_id":2298},"who_affected":{"at":"2026-11-09T15:29:20Z","by":"analyst","doc":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q","run_id":2298}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["prestashop"],"ptokens":["prestashop"],"labels":["high","php","prestashop","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124916':15A,18A '-2026':14A,17A 'admin':9A 'back':3A 'back-offic':2A 'code':12A 'cve':13A,16A 'debug':5A 'let':7A 'offic':4A 'php':11A 'prestashop':1A,19A 'run':10A 'set':6A","search_b":"'back':38B 'back-offic':37B 'code':56B 'configur':44B 'cooki':30B 'debug':29B 'enough':47B 'escap':48B 'file':45B,51B 'host':25B 'inject':54B 'load':53B 'name':31B 'offic':39B 'perform':36B 'php':20B,43B,55B 'prestashop':21B,26B 'privileg':63B 'run':57B 'runtim':22B 'self':24B 'self-host':23B 'server':61B 'set':40B 'valu':33B 'web':60B 'without':46B 'write':27B","search_c":"'authent':67C 'back':75C,84C 'back-offic':74C,83C 'code':69C,125C 'configur':81C,113C 'contain':65C 'cooki':98C,102C 'craft':96C 'debug':79C,91C,97C,101C 'debug-mod':78C 'escap':109C 'execut':127C 'file':114C,121C 'generat':120C 'inject':70C,123C 'load':118C 'mode':80C 'modifi':90C 'name':99C 'offic':76C,85C 'perform':77C 'permiss':88C 'php':68C,112C,124C 'prestashop':64C,116C 'privileg':130C 'process':136C 'server':135C 'set':92C 'subsequ':117C 'suffici':108C 'suppli':94C 'user':86C 'valu':103C 'vulner':71C 'web':134C 'web-serv':133C 'without':107C 'written':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:35:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124916","severity":null,"published_at":"2026-11-09T15:17:19+00:00","modified_at":"2026-11-09T15:17:19+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","fetched_at":"2026-11-09T15:27:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124916:2298","url":null,"severity":null,"published_at":"2026-11-09T15:29:20+00:00","modified_at":"2026-11-09T15:29:20+00:00","first_seen_at":"2026-11-09T15:29:20+00:00","fetched_at":"2026-11-09T15:29:20+00:00","note":"Read GHSA-95f5-jc9c-gg3q (vendor): affected 9.0.0 to <9.2.1, fixed 9.2.1, CVSS 7.2, workaround restrict Performance permission. No exploitation or PoC seen; no social search (web-cli out of credits)."}],"documents":[{"id":108024,"url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T12:35:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}