CVE-2025-61923CWE-22path-traversal

CVE-2025-61923

Medium · published October 16, 2025

CVSS v3.1
4.1
EPSS
1%
Percentile
60.0
In the wild
Unconfirmed
What it is

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00920 · 60.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-16T22:15Z
Affected products (5)
ProductVersionsFixed in
prestashop/prestashop_checkout< 7.4.4.17.4.4.1
prestashop/prestashop_checkout≥ 7.5.0.1, < 7.5.0.57.5.0.5
prestashop/prestashop_checkout≥ 8.3.1.0, < 8.4.4.18.4.4.1
prestashop/prestashop_checkout≥ 8.5.0.0, < 8.5.0.58.5.0.5
prestashop/prestashop_checkout≥ 9.4.3.1, < 9.5.0.59.5.0.5
References (1)
https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-fpxp-pfqm-x54w · [email protected]
EPSS history
Timeline
  • 16 OCT 17:31Z
    PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
    cvelistv5