MEDIUM 6.5

GHSA-m9r4-3fg7-pqm2

PrestaShop path traversal

Details

### Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path.

### Patches 8.1.1

### Found by Aleksey Solovev (Positive Technologies)

### Workarounds none

### References none

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist / prestashop/prestashop

Introduced in: 0 Fixed in: 8.1.1

Fix composer require prestashop/prestashop:^8.1.1

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m9r4-3fg7-pqm2 [WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-39525 [ADVISORY]
https://github.com/PrestaShop/PrestaShop/commit/c7c9a5110421bb2856f4d312ecce192d079b5ec7 [WEB]
https://github.com/PrestaShop/PrestaShop [PACKAGE]