PHP Code Injection Vulnerability in PrestaShop by PrestaShop

CVE-2026-124916

What is CVE-2026-124916?

An authenticated PHP code injection vulnerability exists in PrestaShop’s back-office Performance debug-mode settings. A back-office user with appropriate permissions can inject malicious PHP code by modifying the debug_cookie_name or debug_cookie_value attributes. This input is inadequately sanitized before being written to a PHP configuration file. When PrestaShop processes this file, the injected code could be executed with the same privileges as the web server, posing a significant security risk.

References