CVE-2026-54159

Name of the Vulnerable Software and Affected Versions ps facetedsearch versions 3.0.0 through 4.0.3

Description An unauthenticated PHP Object Injection flaw exists in the ps facetedsearch module. The module rebuilds search filters from the request URL, where values for slider filters, specifically price or weight, are accepted without sufficient validation. These values are stored in an internal filter-block cache in a serialized format and subsequently processed using a raw native unserialize() function within src/Filters/Block.php. An attacker can exploit this by smuggling a malicious serialized PHP object into the cache. Upon deserialization, a gadget chain allows the attacker to write an arbitrary PHP file into the modules/ps facetedsearch/ directory, which can be used as a webshell to execute remote commands and fully compromise the server.

Recommendations Upgrade the ps facetedsearch module to version 4.0.4. In the getFromCache() method within src/Filters/Block.php, replace the native unserialize() call with Tools::unSerialize(). Remove price and weight slider filters from the filter templates exposed on the front office. Clear the faceted-search filter cache and audit the modules/ps facetedsearch/ directory for unexpected PHP files. Monitor search requests for PHP serialization patterns and block them at the WAF level.