PT-2025-42515 · Prestashop · Prestashop Checkout

Inem0O · Published 2025-10-16 · Updated 2026-01-03 · CVE-2025-61923

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop Checkout versions prior to 4.4.1 and 5.0.5

Description The PrestaShop Checkout module is susceptible to a directory traversal and arbitrary file disclosure due to missing input validation in the backoffice. This allows unauthorized access to files.

Recommendations Update to PrestaShop Checkout version 4.4.1 for PrestaShop 1.7. Update to PrestaShop Checkout version 4.4.1 for PrestaShop 8. Update to PrestaShop Checkout version 5.0.5 for PrestaShop 1.7. Update to PrestaShop Checkout version 5.0.5 for PrestaShop 8. Update to PrestaShop Checkout version 5.0.5 for PrestaShop 9.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-61923

GHSA-FPXP-PFQM-X54W

Affected Products

Prestashop Checkout

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61923.json · Exploit
• https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-fpxp-pfqm-x54w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61923 · Security Note
• https://osv.dev/vulnerability/GHSA-fpxp-pfqm-x54w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61923 · Vendor Advisory
• https://github.com/PrestaShopCorp/ps_checkout · Note
• https://twitter.com/VulmonFeeds/status/1979007867655987296 · Twitter Post
• https://twitter.com/transilienceai/status/2007293632873697419 · Twitter Post
• https://twitter.com/CVEnew/status/1978926573358100620 · Twitter Post
• https://t.me/CVEtracker/35129 · Telegram Post
• https://t.me/cveNotify/147077 · Telegram Post