CVE-2023-39528

PrestaShop prior to 8.1.1 is affected by a path-traversal in displayAjaxEmailHTML that can read arbitrary server files if the server is misconfigured. The issue is fixed in version 8.1.1 (patch referenced in multiple sources). The CVE describes a file-reading vulnerability leading to potential ex...

CVE-2023-39528 PrestaShop vulnerable to file reading through path traversal

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are ...