VU#385711 PrestaShop debug mode flaw allows PHP code injection

PrestaShop, an open-source e-commerce platform for creating and managing online stores, contains a PHP code injection vulnerability in the back-office Performance Debug mode feature. An authenticated attacker with permission to modify debug-mode configuration could execute arbitrary code with the privileges of the PHP process.

The flaw is tracked as CVE-2026-124916. Debug mode is enabled according to a specified cookie name and value in the Performance configuration. The user-controlled debug_cookie_name and debug_cookie_value values are inserted into a PHP expression without adequate escaping or sanitization, and that expression is written into a PHP define() statement in config/defines.inc.php or config/defines_custom.inc.php. A crafted value can end the intended string and add attacker-controlled PHP statements. The modified file is loaded during application initialization, so the injected code runs on a later request.

Exploitation requires an authenticated back-office account holding permission to modify debug mode settings, along with a configuration file the PHP process can write to. Root or operating-system administrator privileges are not required. Cross-site request forgery protection blocks unauthorized requests sent through another user's session but does not stop an attacker who controls an account with the required permissions. Injected code runs with the privileges of the PHP process. Affected release versions have yet to be confirmed.

An authenticated attacker with the required configuration permissions could run arbitrary PHP code in the security context of the PHP process. Described consequences include access to application secrets and customer data, modification or deletion of application files and database contents, and disruption of store operations. Operating-system command execution depends on the PHP configuration and available functions. The vulnerability does not independently grant root privileges.

PrestaShop version 9.2.1 addresses this vulnerability, and affected installations should be upgraded to version 9.2.1 or later. The document was first published and made public on 2026-11-09, last updated at 14:53 UTC that day, and is at revision 1.

If an immediate upgrade is not possible, limit changes to Performance and Debug mode settings to trusted administrators and restrict network access to the back office. Where operationally feasible, prevent the PHP process from writing to config/defines.inc.php and config/defines_custom.inc.php, though this may also block legitimate configuration changes. Deflask13 is credited with reporting the vulnerability, and Michael Bragg wrote the document.