CVE-2023-39528
highpriority · track · 34EPSS 0.008 · 55 %ileEUUSEPSS · scored 2026-10-28
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–8.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-hpf4-v7v2-95p2PrestaShop file access through path traversal2023-08-09ghsa · osvUS
### Impact `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. This vulnerability can be exacerbated when coupled with [CWE-502](https://cwe.mitre.org/data/definitions/502.html), which pertains to the Deserialization of Untrusted Data. Such a combination could potentially lead to a Remote Code Execution (RCE) vulnerability ### Patches 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds ### References
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-39528/cnnvd
- https://github.com/PrestaShop/PrestaShop/commit/11de3a84322fa4ecd0995ac40d575db61804724ccnnvd
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hpf4-v7v2-95p2cnnvd
- https://github.com/PrestaShop/PrestaShop/commit/11de3a84322fa4ecd0995ac40d575db61804724cenisa_euvd
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hpf4-v7v2-95p2enisa_euvd
- https://github.com/PrestaShop/PrestaShop/commit/11de3a84322fa4ecd0995ac40d575db61804724cPatchnvd
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hpf4-v7v2-95p2Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan