CVE-2026-85520
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated…
- Risk score
- 83/100
- CVSS
- 9.3 v4.0
- Exploit chance (30 days)
- 1.0%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authenticatio…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.3.9 or later.
- Exploitation
- No known exploitation
Why it is Red
- CVSS 9.3 critical
- Remotely exploitable without logging in
- On your watchlist: php
References
Original description
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.
Last activity 29 Sep 2026. Patch Forecast updates every hour.