PrestaShop fixes authenticated PHP code injection in debug configuration
PrestaShop 9.2.1 fixes an authenticated PHP code-injection vulnerability in the back-office Performance and Debug mode configuration, according to a CERT vulnerability note published on November 9, 2026. The issue is tracked as CVE-2026-124916, and the note says affected release versions have not yet been confirmed.
An attacker needs an authenticated back-office account that can modify debug-mode settings. The CERT note says the attacker can submit crafted cookie configuration values that PrestaShop writes into an executable PHP configuration file, provided that file is writable by the PHP process.
The vulnerable code places the user-controlled debug_cookie_name and debug_cookie_value into a PHP expression without adequate escaping or sanitisation, according to CERT. A crafted value can end the intended string and add PHP statements. The modified configuration file is then loaded during a later request, causing the injected code to run with the PHP process's privileges.
CERT says successful exploitation could expose application secrets and customer data, change or delete application files and database contents, and disrupt store operations. The flaw does not by itself provide root privileges, while operating-system command execution depends on the PHP configuration and the functions available to it.
Administrators should upgrade affected installations to PrestaShop 9.2.1 or later, the note says. Until an upgrade is possible, they should allow only trusted administrators to change Performance and Debug mode settings and restrict network access to the back office. Where operationally feasible, they can prevent PHP from writing to config/defines.inc.php and config/defines_custom.inc.php, although CERT warns that this may block legitimate configuration changes.