# CVE-2025-25691: PrestaShop PHAR deserialization in theme import

Source: https://junglewise.ai/threats/cve-2025-25691-prestashop-phar-deserialization-in-theme-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-30. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-25691 · Severity: medium · CVSS 6.5 · Published 2025-07-30

PrestaShop, a popular open-source e-commerce platform, contains a security vulnerability in its theme import feature. An attacker can exploit this flaw to execute unauthorized code on the server hosting the online store. This could lead to a full compromise of the website, including the theft of customer data or disruption of business operations.

Technologies: [PrestaShop](https://junglewise.ai/threats/technologies/prestashop). Vendors: [PrestaShop](https://junglewise.ai/threats/vendors/prestashop).

## Quick answers

**Is CVE-2025-25691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-25691 being exploited in the wild.

**How severe is CVE-2025-25691?** Medium severity, with a CVSS score of 6.5, published 30 July 2025.

**Which products and versions are affected?** PrestaShop 8.2.0.

**Is there a fix for CVE-2025-25691?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-25691 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-25691?** Check whether you run PrestaShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PHAR (PHP Archive) deserialization vulnerability exists within the theme import functionality (/themes/import) of PrestaShop v8.2.0. The flaw is triggered when the application improperly handles untrusted data during a POST request, leading to insecure deserialization. An attacker can leverage this to achieve remote code execution (RCE) or command injection (CWE-77). The vulnerability is reachable over the network without requiring specific user interaction, though the CVSS assessment suggests limited impact on confidentiality and integrity despite the potential for code execution. A proof-of-concept exploit has been identified in third-party repositories.

## Affected products

- PrestaShop PrestaShop 8.2.0

## Timeline

- 2025-07-30: advisory: Initial NVD publication date

## References

- [http://dem0.com/](http://dem0.com/)
- [http://dem0.com/admin/index.php/improve/design/themes/import?_token=btRUtV2Om2noliZZjeFQZhlMY3gYivjABbPOjP91L6U](http://dem0.com/admin/index.php/improve/design/themes/import?_token=btRUtV2Om2noliZZjeFQZhlMY3gYivjABbPOjP91L6U)
- [https://github.com/3em0/cve_repo/blob/main/preshop/CVE-2025-25691.md](https://github.com/3em0/cve_repo/blob/main/preshop/CVE-2025-25691.md)
- [https://github.com/PrestaShop/PrestaShop](https://github.com/PrestaShop/PrestaShop)

## Related threats

- [PrestaShop PHP code injection in debug mode configuration](https://junglewise.ai/threats/cve-2026-124916-prestashop-contains-an-authenticated-php-code-injection)
- [PrestaShop IP address spoofing in getRemoteAddr()](https://junglewise.ai/threats/cve-2026-84186-prestashop-ip-address-spoofing-in-getremoteaddr)
- [PrestaShop CSV injection in Alias parameter](https://junglewise.ai/threats/cve-2026-14846-prestashop-csv-injection-in-alias-parameter)
- [PrestaShop stored XSS in Customer Service view via Contact Us form](https://junglewise.ai/threats/cve-2026-44212-prestashop-stored-xss-in-customer-service-view-via-contact-us)
- [PrestaShop PHAR deserialization in _getHeaders function](https://junglewise.ai/threats/cve-2025-25692-prestashop-phar-deserialization-in-getheaders-function)