MEDIUM6.5

GHSA-m9r4-3fg7-pqm2

PrestaShop path traversal

Quick fix

GHSA-m9r4-3fg7-pqm2 — prestashop/prestashop: upgrade to the fixed version with the command below.

composer require prestashop/prestashop:^8.1.1

Details

### Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path.

### Patches 8.1.1

### Found by Aleksey Solovev (Positive Technologies)

### Workarounds none

### References none

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/prestashop/prestashop

Introduced in: 0Fixed in: 8.1.1

Fixcomposer require prestashop/prestashop:^8.1.1

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m9r4-3fg7-pqm2[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-39525[ADVISORY]
https://github.com/PrestaShop/PrestaShop/commit/c7c9a5110421bb2856f4d312ecce192d079b5ec7[WEB]
https://github.com/PrestaShop/PrestaShop[PACKAGE]