CVE-2025-61923: medium-severity vulnerability in PrestaShopCorp ps_checkout
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.1epss 0.9%
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Affected products
PrestaShopCorp · ps_checkoutRelated CVEs — PrestaShopCorp ps_checkout
In the same product, most dangerous first.