PT-2026-102512 · Prestashop · Google Merchant Center Feed
CVE-2026-85520
·
Published
2026-09-29
·
Updated
2026-09-29
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
Google Merchant Center Feed (gmfeed) module for PrestaShop versions prior to 2.3.9
Description
An unauthenticated arbitrary file write exists in the 'feed.php' endpoint. An attacker can send a crafted request to control the output file name, path, extension, and content. Due to missing authentication and input validation, this allows the writing and execution of arbitrary PHP code, leading to remote code execution (RCE), which is the ability to execute commands on a remote machine over a network.
Recommendations
Update the Google Merchant Center Feed (gmfeed) module to version 2.3.9.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Google Merchant Center Feed