PrestaShop, the open-source e-commerce platform used to run online stores, contains a PHP code injection flaw in its back-office debug settings, and administrators should upgrade to version 9.2.1 or later. The flaw, tracked as CVE-2026-124916 and CERT/CC vulnerability note VU#385711, was published on 9 November 2026.

The weakness sits in the Performance section of the back office, where developers can switch on Debug mode using a specified cookie name and value. PrestaShop writes those user-controlled values, debug_cookie_name and debug_cookie_value, into a PHP expression without adequately escaping or sanitising them for use in PHP source code.

How the flaw can be exploited

The application writes the expression into a define() statement in config/defines.inc.php or config/defines_custom.inc.php. A crafted value can end the intended string early and introduce attacker-controlled PHP statements. Because the modified configuration file is loaded during application initialisation, the injected code executes on a subsequent request.

Exploitation needs an authenticated back-office account with permission to modify debug-mode settings, and a configuration file that the PHP process can write to. Cross-site request forgery protection helps prevent unauthorised requests made through another user's session, but it does not stop an attacker who controls an account with the required permissions. Root or operating-system administrator privileges are not required, and the injected code runs with the privileges of the PHP process.

What is at risk

An authenticated attacker with the required configuration permissions could execute arbitrary PHP code in the security context of the PHP process. According to CERT/CC, that could allow access to application secrets and customer data, modification or deletion of application files and database contents, and disruption of store operations. Operating-system command execution depends on the PHP configuration and available functions, and the flaw does not by itself grant root privileges.

CERT/CC credits researcher Deflask13 with reporting the vulnerability. The affected release versions remain to be confirmed, but PrestaShop version 9.2.1 addresses the flaw, and administrators should upgrade affected installations to 9.2.1 or later.

What to do if you cannot upgrade yet

If an immediate upgrade is not possible, CERT/CC advises allowing only trusted administrators to modify Performance and Debug mode settings, and restricting network access to the back office. Where operationally feasible, administrators should prevent the PHP process from writing to config/defines.inc.php and config/defines_custom.inc.php, although CERT/CC notes this may also prevent legitimate configuration changes.

Store owners should also review who holds back-office accounts with configuration permissions, since the flaw is only reachable by someone already signed in with those rights. Removing unused admin accounts and tightening back-office access reduces the chance that a compromised or malicious account can turn this setting into full control of the store.