VDB
Sign up
MEDIUM4.1

GHSA-fpxp-pfqm-x54w

PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

Quick fix

GHSA-fpxp-pfqm-x54w — prestashop/ps_checkout: upgrade to the fixed version with the command below.

composer require prestashop/ps_checkout:^4.4.1

Details

# Impact Missing validation on input vulnerable to directory traversal.

# Patches The problem has been patched in versions:

v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1) v4.4.1 for PrestaShop 8 (build number: 8.4.4.1) v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5) v5.0.5 for PrestaShop 8 (build number: 8.5.0.5) v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.

# Credits [Léo CUNÉAZ](https://github.com/inem0o) for reportied this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/prestashop/ps_checkout
Introduced in: 0Fixed in: 4.4.1
Fixcomposer require prestashop/ps_checkout:^4.4.1
Packagist/prestashop/ps_checkout
Introduced in: 5.0.0Fixed in: 5.0.5
Fixcomposer require prestashop/ps_checkout:^5.0.5

References