GitHub Advisoryadvisory · Packagist

GHSA-fpxp-pfqm-x54w PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

MEDIUM Published 2025-10-16 Modified 2025-10-16 Official page ↗
Aliases
CVE-2025-61923
Ecosystem
Packagist
Packages
prestashop/ps_checkout
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2025-10-16

Affected packages

• Packagist prestashop/ps_checkout: < 4.4.1 → fixed in 4.4.1 • Packagist prestashop/ps_checkout: >= 5.0.0, < 5.0.5 → fixed in 5.0.5

Description

Impact Missing validation on input vulnerable to directory traversal. Patches The problem has been patched in versions: v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1) v4.4.1 for PrestaShop 8 (build number: 8.4.4.1) v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5) v5.0.5 for PrestaShop 8 (build number: 8.5.0.5) v5.0.5 for PrestaShop 9 (build number: 9.5.0.5) Read the Versioning policy to learn more about the build number. Credits Léo CUNÉAZ for reportied this issue.

Related

Alias · CVE (1)

  • CVE-2025-61923 PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References