Initialy flagged as path traversal with a medium severity, the work of Friends Of Presta Security team proven the ability to use this vulnerability to implicity deserialize a malicious load (critical severity).


  • CVE ID: CVE-2023-39528
  • Published at: 2023-08-07
  • Advisory source: PrestaShop
  • Platform: PrestaShop
  • Product: PrestaShop
  • Impacted release: <= 8.1.0 (Patched versions 8.1.1)
  • Weakness: CWE-22 and CWE-502
  • Severity: critical (9.1)


displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured.

Moreover, any wrapper like https, ftp, phar, … can be exploited to forge a SSRF (server side request forgery). The ability to use phar:// can be exploited to forge an unserialization as proven in our security research advisory “Exploring the perils of implicit deserialization of a phar in PrestaShop (part 2)”

CVSS base metrics

  • Attack vector: network
  • Attack complexity: low
  • Privilege required: high
  • User interaction: none
  • Scope: changed
  • Confidentiality: high
  • Integrity: high
  • Availability: high

Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Possible malicious usage

Mailicious usage in PrestaShop via commons libraries are :

  • remote code execution (RCE) to put a webshell
  • Server Side Request Forgery (SSRF) to agress other website with a clean IP,
  • File Deletion (FD) to remove an htaccess and expose logs or sensitive data,
  • File Writer (WF) to put a webshell
  • Files read reader (RF) to read sensitive data like mysql password,
  • SQL injections (SQLi),
  • Technical data leaks (Info).

See also: “Exploring the perils of unsafe unserialize() in PrestaShop (part 1)


--- a/controllers/admin/AdminTranslationsController.php
+++ b/controllers/admin/AdminTranslationsController.php
@@ -3296,7 +3296,7 @@ public static function getEmailHTML($email)
             $email_file = _PS_ROOT_DIR_ . $email;
-        if (file_exists($email_file)) {
+        if (strpos(realpath($email_file), _PS_ROOT_DIR_) === 0 && file_exists($email_file)) {
             $email_html = file_get_contents($email_file);
         } else {
             $email_html = '';

Other recommendations

Phar wrapper cannot be disabled via a php.ini settings.

As a developer:

  • A strict validation of input data is absolutely essential !
  • Use basename() PHP method to prevent path traversal getimagesize(basename($_GET['param'])) and unwanted use of wrapper such as phar://
  • Use GD library to remove dummy serialized data on an image.

As an adminsys