CVE-2026-85520: Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE).
This issue was fixed in version 2.3.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PrestaShop Google Merchant Center Feed (gmfeed) moduleto a version that resolves this vulnerability.Fixed in 2.3.9
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
PrestaShop deployments using the Google Merchant Center Feed (gmfeed) module are exposed if they run a version before 2.3.9. The vulnerable feed.php endpoint can be reached without authentication.
What does an attacker need to exploit this issue?
An attacker only needs to send a crafted request to the vulnerable endpoint. The request parameters can control the written file's name, path, extension, and contents, enabling PHP code execution.
What should be done to remediate the vulnerability?
Update the gmfeed module to version 2.3.9, which fixes the issue.