CVE-2026-124916 PrestaShop Performance Debug Configuration PHP Code Injection
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124916?
CVE-2026-124916 is a medium-severity vulnerability in PrestaShop, published on 9 Nov 2026.
Official description
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
Weakness: CWE-79
Which versions are affected by CVE-2026-124916?
How do I fix CVE-2026-124916?
No fix has been published for CVE-2026-124916 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124916 being exploited?
There is no known exploitation of CVE-2026-124916 in the wild and no public exploit code.
Sources
Also known as GHSA-3qxg-mfwq-q6pp.