CVE-2026-124916: PrestaShop Performance Debug Configuration PHP Code Injection
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated back-office user who has permission to modify debug settings can exploit it. The attacker must be able to submit crafted values for debug_cookie_name or debug_cookie_value.
What happens after a malicious debug cookie setting is saved?
The crafted value is written into a PHP configuration file without sufficient escaping. When PrestaShop later loads that generated file, the injected PHP runs with the privileges of the web-server process.
How can administrators determine whether they may be affected?
Review which back-office accounts or roles can modify Performance debug-mode settings, and inspect debug cookie configuration values for unexpected or code-like content. The provided information does not identify affected versions or a fixed release.