Exploit for CVE-2026-85520

CVE-2026-85520 — PrestaShop gmfeed unauthenticated arbitrary f...

CVE-2026-85520

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

CVE-2026-85520 Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

CVE-2026-85520

The gmfeed (Google Merchant Center Feed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write via the feed.php endpoint. The root cause is a lack of authentication and input validation, which allows an attacker to control the output filename, path, extension, and content th...

CVE-2026-85520 Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

EUVD-2026-88735

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

CVE-2026-85520: External Control of File Name or Path

Google Merchant Center Feed gmfeed module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the...

PT-2026-102512

Name of the Vulnerable Software and Affected Versions Google Merchant Center Feed gmfeed module for PrestaShop versions prior to 2.3.9 Description An unauthenticated arbitrary file write exists in the 'feed.php' endpoint. An attacker can send a crafted request to control the output file name, pat...