CVE-2026-85520 json
Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module
published 2026-09-29 40 d ago modified 2026-09-30 39 d ago also EUVD-2026-88735
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE).
This issue was fixed in version 2.3.9.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 40 d ago
Exploit prediction
0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- MyPresta Google Merchant Center Feed
Classification
- Weakness
-
- CWE-73 External Control of File Name or Path
References
-
cert.pl
/en/posts/2026/09/CVE-2026-85520
third-party-advisory
-
mypresta.eu
/news/google-merchant-center-security-fix-2026.html
mitigation
Sources
- CVE List CVE-2026-85520
- NVD CVE-2026-85520
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.