Headline
CVE-2023-39528: Reading a file through path traversal
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
Package
composer prestashop/prestashop (Composer)
Affected versions
<= 8.1.0
Description
Impact
displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured
Patches
8.1.1
Found by
Aleksey Solovev (Positive Technologies)
Workarounds****References
Related news
### Impact `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured ### Patches 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds ### References