Detections
Analytics
CVE-2026-124916
medium
Description
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
References
https://www.kb.cert.org/vuls/id/385711
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q