---
id: "CVE-2026-124916"
page: "https://infrastack.ai/live/CVE-2026-124916"
kind: "vulnerability"
aliases: ["CVE-2026-124916"]
title: "PrestaShop: back-office debug settings let an admin run PHP code"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "prestashop", "fixed": ["9.2.1"], "affected": ">= 9.0.0, < 9.2.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["php", "prestashop", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-untrusted-back-office-users"]
published_at: "2026-11-09T15:17:19+00:00"
first_seen_at: "2026-11-09T15:27:06+00:00"
updated_at: "2026-11-09T15:29:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124916", "first_seen_at": "2026-11-09T15:27:06+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T15:29:20+00:00"}]
exploit_sources: []
---

# PrestaShop: back-office debug settings let an admin run PHP code

Link for people: https://infrastack.ai/live/CVE-2026-124916 (this .md is for agents)

PrestaShop writes the debug cookie name and value from the Performance back-office settings into a PHP configuration file without enough escaping. When the file is loaded, injected PHP code runs with the web server's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:prestashop affected >= 9.0.0, < 9.2.1 fixed 9.2.1

## How to check

- Check the PrestaShop version in the back office; versions 9.0.0 up to but not including 9.2.1 are affected.
- Review which back-office profiles hold Performance page permissions.
- Inspect the debug cookie name and value saved in the Performance page for PHP code, and check the generated PHP file that stores them for unexpected code.

## Fix

Upgrade PrestaShop to 9.2.1. Workaround: limit Performance page access to profiles already trusted with code execution on the server.

## Timeline

- 2026-11-09T15:27:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124916
- 2026-11-09T15:29:20+00:00 analyst — Read GHSA-95f5-jc9c-gg3q (vendor): affected 9.0.0 to <9.2.1, fixed 9.2.1, CVSS 7.2, workaround restrict Performance permission. No exploitation or PoC seen; no social search (web-cli out of credits).

## Documents

- [advisory] Vendor advisory: github.com https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q

## From the sources

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_