CVE-2023-39525

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
PrestaShop	PrestaShop	< 8.1.1

References

Timeline

Published: Aug 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-395269.8PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code executio CVE-2023-395276.1PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting CVE-2023-395288.6PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any f CVE-2023-395299.1PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using th CVE-2023-39535.3A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption w CVE-2023-395309.1PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the Cust CVE-2023-395316.8Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with su CVE-2023-395329.8SES is a JavaScript environment that allows safe execution of arbitrary programs in Compartments. In version 0.18.0 prior to 0.18.7, 0.17.0 CVE-2023-395337.5go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large CVE-2023-395347.5eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 CVE-2023-395357.8AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful explo CVE-2023-395367.8AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful explo