CVE-2025-61923

Published Oct 16, 2025

Last updated 4 months ago

Overview

Description
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Source
security-advisories@github.com
NVD status
Analyzed
Products
prestashop_checkout

Risk scores

CVSS 3.1

Type
Secondary
Base score
4.1
Impact score
1.4
Exploitability score
2.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Severity
MEDIUM

Weaknesses

security-advisories@github.com
CWE-22

Social media

Hype score
Not currently trending

Configurations