CVE-2026-85520
Received Received - Intake

Unauthenticated Arbitrary File Write in PrestaShop Google Merchant Center Feed

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: CERT.PL

Description
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-85520
EUVD
EUVD-2026-88735

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
prestashop google_merchant_center_feed 2.3.9
mypresta google_merchant_center_feed 2.3.9
mypresta google_merchant_center_feed From 1.9.1 (inc) to 2.3.8 (inc)
mypresta google_merchant_center_feed to 2.3.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85520 is an unauthenticated arbitrary file write vulnerability in the Google Merchant Center Feed module for PrestaShop. It affects versions 1.9.1 through 2.3.8 and allows attackers to control file names, paths, extensions, and content via crafted requests to the feed.php endpoint. This can lead to remote code execution (RCE) due to the lack of authentication and input validation.

Detection Guidance

Check if the Google Merchant Center Feed module is installed and its version. Look for suspicious files in the PrestaShop directory, particularly those modified recently. Review server access logs for unusual requests to feed.php with parameters controlling file paths or content.

Impact Analysis

An attacker could exploit this to write and execute arbitrary PHP code on your server, potentially taking full control of your PrestaShop store. This could lead to data theft, defacement, or further compromise of your system. The vulnerability is critical due to its unauthenticated nature and potential for RCE.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, and reputational damage due to exposed customer or sensitive data.

Mitigation Strategies

Uninstall the vulnerable module with the 'delete files' option enabled. Install version 2.4.1 or higher. Ensure a clean reinstall to remove all old files. Update feed URLs if using 'Save to file' and verify the version in Module Manager.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85520. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart