PrestaShop 8.2.9 is available. This is a security-only release for the 8.2 branch that fixes fifteen vulnerabilities, twelve of them rated High, and ships two updated modules (newsletter and GDPR). Several of them can be exploited without any account on the shop. Updating as soon as possible is strongly recommended.

PrestaShop 8.2.9 is available!

Security fixes

  • Stored XSS through SVG files uploaded with the back office file manager and logo uploader (Severity: High 8.7/10, CWE-79)
    • Identifier: GHSA-99cp-c6mm-p7h5
    • Requires admin access: a back office employee account.
    • SVG files uploaded through the back office file manager or as the shop logo were accepted even when they contained scripts. A crafted file could then run JavaScript in the browser of whoever displayed it, including other employees. Such SVG files are now rejected.
  • Path traversal in attachments allows file read and deletion outside the download directory (Severity: High 8.5/10, CWE-22)
    • Identifier: GHSA-wrmc-gmx5-9hhc
    • Requires a webservice key: a webservice key with write permission on attachments.
    • Attachment files were not strictly kept inside the download directory, so an attacker with write access to attachments could read or delete files elsewhere on the server. This completes the fix of CVE-2023-39529.
  • Webservice API cross-tenant customer takeover via missing record-level shop check (Severity: High 8.1/10, CWE-639, CWE-862)
    • Identifier: GHSA-hjwq-7qvv-qxj4, CVE-2026-71519
    • Requires a webservice key: a webservice key allowed on at least one shop of a multistore installation.
    • On multistore installations, the webservice did not check that a requested record belonged to a shop the API key was allowed on. A key limited to one shop could reach the customers of another shop, up to taking over their accounts.
  • Installer can be re-run without an already-installed check, allowing configuration overwrite (Severity: High 8.1/10, CWE-306, CWE-862)
    • Identifier: GHSA-8rxw-79mh-gmm5
    • The web installer did not check whether the shop was already installed. When the installer was still reachable, anyone could run it again and overwrite the shop configuration. It now refuses to run on an installed shop.
  • Unauthenticated PHP object injection in the installer session cookie leads to remote code execution (Severity: High 8.1/10, CWE-502)
    • Identifier: GHSA-h2q4-7fp7-m5jp
    • The installer restored its session from a cookie without making sure the content was safe to unserialize. A visitor sending a crafted cookie to a reachable installer could execute code on the server.
  • Webservice API multishop scope bypass via id_shop=all / id_shop_group (Severity: High 8.1/10, CWE-862, CWE-863)
    • Identifier: GHSA-3f36-4qv4-vfgh, CVE-2026-71531
    • Requires a webservice key: a webservice key restricted to some shops.
    • By adding id_shop=all or an id_shop_group parameter to a request, an API key restricted to some shops could reach the data of every shop in the installation. Keys now stay within the shops they are allowed on.
  • Cart rule usage limits can be bypassed through a race condition in order validation (Severity: High 7.5/10, CWE-367)
    • Identifier: GHSA-r246-6gw4-pj3p
    • By validating several orders at the same time, a customer could use a cart rule more times than its quantity allows. The remaining quantity is now taken into account when the order validation checks the cart rule.
  • Duplicate orders can be created from a single cart through a race condition in free-order checkout (Severity: High 7.5/10, CWE-362, CWE-367)
    • Identifier: GHSA-2676-hc74-gg7v
    • When the order total was zero, concurrent checkout requests on the same cart could each create an order. A single cart now leads to a single order.
  • Path traversal in theme and module import allows an authenticated administrator to write files outside the intended folder (Severity: High 7.2/10, CWE-22, CWE-434)
    • Identifier: GHSA-7q68-ch46-pxmc
    • Requires admin access: a back office employee allowed to import themes or modules.
    • The content of an imported theme or module archive was not kept inside its destination folder, so a crafted archive could write files anywhere the web server can write, leading to code execution.
  • Arbitrary file inclusion through the module parameter of the back office translations page (Severity: High 7.2/10, CWE-98)
    • Identifier: GHSA-fxq4-2mc8-99pr
    • Requires admin access: a back office employee with access to the translations page.
    • The module name passed to the translations page was used to load a file without being checked, which allowed an employee with access to that page to execute code. Translation files are now only loaded for installed modules, and PHP archives are rejected in import uploads.
  • Remote code execution through the theme “Import from the web” feature (Severity: High 7.2/10, CWE-434)
    • Identifier: GHSA-95w6-v2wq-cv8w
    • Requires admin access: a back office employee allowed to import themes.
    • A theme archive imported from a URL was saved into the admin directory, where a crafted file could be executed. Downloaded archives now go to the cache directory.
  • Path traversal in back office email translations allows arbitrary file write (Severity: High 7.2/10, CWE-22, CWE-94)
    • Identifier: GHSA-5p6p-mx64-96jf
    • Requires admin access: a back office employee with access to email translations.
    • The mail template name was not always validated before translation files were written, so an employee with access to email translations could write a PHP file outside the mails folder and execute it.
  • Unauthenticated disclosure of a customer’s customization file through the order reference (Severity: Medium 5.9/10, CWE-639, CWE-863)
    • Identifier: GHSA-fg9q-mm4c-h5xc
    • Files uploaded by customers to customize a product could be downloaded by anyone knowing the order reference. The download now also requires the order secure key.
  • Back office employees with create-only order permission can modify existing orders (Severity: Medium 4.9/10, CWE-862, CWE-863)
    • Identifier: GHSA-mgcf-mrg4-mcxv
    • Requires admin access: a back office employee with the create permission on orders.
    • An employee only allowed to create orders could add products to existing ones. This now requires the order edit permission.
  • Predictable password reset token allows a customer account takeover (Severity: Medium 4.8/10, CWE-330)
    • Identifier: GHSA-g6p7-cx52-hcrj
    • Password reset tokens were derived from predictable values, so someone who knew a customer’s secure key could guess the token and take over the account. Tokens are now generated with a cryptographically secure random generator.

Full technical details, attack vectors, and workarounds are documented in each advisory.

These issues are also fixed in PrestaShop 9.2.1, released simultaneously, which additionally fixes three vulnerabilities that only concern PrestaShop 9.

Module updates

PrestaShop 8.2.9 also ships version 3.0.1 of the ps_emailsubscription module, which fixes a CSV injection in the subscribers export (GHSA-pg6j-qf29-gc43, Medium 6.1/10, CWE-1236). Email addresses starting with a formula character were accepted at newsletter sign-up and written as-is in the export, so they could be interpreted as formulas when an administrator opened the file in a spreadsheet application.

PrestaShop 8.2.9 also ships version 1.4.4 of the psgdpr module, which fixes an insecure direct object reference in the front office consent logging (GHSA-wwqh-cf9m-347f, CVE-2026-92809, Medium 5.3/10, CWE-639). The module trusted the customer id sent in the request, so anyone, even a visitor without an account, could record a consent on behalf of another customer in the GDPR log.

If you do not update the shop right away, you can update these modules on their own from the Module Manager.

Update to PrestaShop 8.2.9

Updating your shop to version 8.2.9 is highly recommended. You can use the Update Assistant to perform the update.

Always remember to make a full backup of your database and files before performing any update.

If you encounter any problems during the update that, in your opinion, are not caused by third-party modules or modifications used in your shop, submit a bug report.

Download

The Classic edition now ships PrestaShop Checkout 5.5.6 (8.5.5.6), which includes the fixes of the module advisories GHSA-6q9v-2g94-hxm5 and GHSA-678f-q3v5-9fw4.

Download PrestaShop 8.2.9 now!

PrestaShop 9

If you are looking for the latest features and a more modern architecture, we encourage you to check out PrestaShop 9.2. PrestaShop 9.2 brings One Page Checkout, Ask AI, and Extra Properties on top of the modernized foundation introduced in PrestaShop 9.

As a reminder, PrestaShop 8.2.x is in its extended support phase and now receives only security and critical fixes. Start planning your migration today to benefit from the latest innovations in the PrestaShop ecosystem.

Full changelog

Acknowledgments

This security release was made possible thanks to a coordinated disclosure process between external researchers and the PrestaShop maintainers team. Many of these issues were reported by several researchers independently: each of them is credited below.

We would like to thank:

  • Nguyễn Vương Tuấn Hiệp (nvth) for the stored XSS through SVG uploads;
  • Jean-Jamil Khalife (HDW Sec), and independently Abraxas Labs, Calif.io in collaboration with Anthropic, Nikhil Thomas and Ayushman Dubey (Warpnet), and Bani Montoya, for the path traversal in attachments;
  • a researcher coordinated by VulnCheck, and independently boo-code and Gurvir Bajwa, for the webservice cross-tenant customer takeover;
  • a researcher coordinated by VulnCheck, and independently Sakil Ahamed Gayen and Gurvir Bajwa, for the webservice multishop scope bypass;
  • Bilguundalai, and independently Wenhao Wu (Southeast University), for the installer re-run;
  • Wenhao Wu (Southeast University) for the customization file disclosure;
  • Kamaldeep Rajal, and independently Santhoshkumar S, for the object injection in the installer session cookie;
  • NEC Security, and independently Mufeed VH (Winfunc Research), for the cart rule usage limit bypass;
  • Mufeed VH (Winfunc Research) for the duplicate orders in free-order checkout and the order permission issue;
  • Vitish Bhardwaj, and independently tuan nguyen, VulnCheck, Duc Anh Le and JoyBoy, for the path traversal in theme and module import;
  • Leonardo Kauan for the file inclusion through the translations page;
  • Viet Son for the remote code execution through the theme “Import from the web” feature;
  • Mukul Goyal (parameter.ai), and independently boo-code, for the path traversal in email translations;
  • Savio (Doyensec) in collaboration with Anthropic Research, and independently Sanghyeon Lee, Dawit Jeong, Amit Chavan and abraxas, for the predictable password reset token.

On the maintainers side, thank you to @M0rgan01, @mattgoud, @nicosomb, @clotairer, @Quetzacoalt91 and @jolelievre for analysing the reports and preparing the patches, and to @seiwan for the PrestaShop Checkout advisories.

Thank you to everyone who contributes to keeping PrestaShop secure! Reporting responsibly, reviewing a patch, or testing a fix before it ships all make a real difference.

Want to help? Start contributing today, or report a security issue to [email protected].

clotairer clotairer jolelievre jolelievre M0rgan01 M0rgan01 mattgoud mattgoud nicosomb nicosomb Quetzacoalt91 Quetzacoalt91 seiwan seiwan