PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables

中 5.4CVE-2026-33673 · GHSA-35pf-37c6-jxjv · 26/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-33673 は prestashop/prestashop, prestashop (prestashop) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.27%（全脆弱性の 20.0% より高い）。
対処：9.1.0, 8.2.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
prestashop/prestashop Packagist	`≥ 9.0.0-alpha.1, < 9.1.0< 8.2.5`	`9.1.08.2.5`
prestashop prestashop	`≥ 9.0.0, < 9.1.0< 8.2.5`	`9.1.08.2.5`

概要

Impact

Multiple stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO: an attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates.

Patches

Patched on 8.2.5 and 9.1.0

Workarounds

None

References

None

NVD の説明

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates. Versions 8.2.5 and 9.1.0 contain a fix. No known workarounds are available.