Executive brief
A security vulnerability exists in the PrestaShop 'ps_facetedsearch' module, which provides navigation filters for online stores. An unauthenticated attacker can exploit this flaw by sending a specially crafted web request to a store's search page. This allows the attacker to take full control of the server, potentially leading to the theft of customer data, site defacement, or a complete service outage.
Technical details
A PHP Object Injection vulnerability exists in the PrestaShop ps_facetedsearch module (versions 3.0.0 to 4.0.3). The module fails to sufficiently validate slider filter values (such as price or weight) taken from the request URL before storing them in an internal filter-block cache. These values are subsequently retrieved and processed using the native PHP 'unserialize()' function in 'src/Filters/Block.php'. An unauthenticated remote attacker can provide a malicious serialized PHP object that, when deserialized, triggers a gadget chain to write an arbitrary PHP file (webshell) into the module directory. This results in full remote code execution (RCE). The issue is resolved in version 4.0.4 by replacing the native unserialize call with a secure wrapper.
Affected products
- PrestaShop ps_facetedsearch >= 3.0.0, < 4.0.4
Timeline
- 2026-06-03: patched: Version 4.0.4 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE-2026-54159 published to NVD