by Kastro
Paper/Archive/CVE-2026-85520

CVE-2026-85520

MyPresta Google Merchant Center Feed — Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

EPSS 1.0%CVSS 9.3
critical.is priorityof 100
40
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 62.5.625 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

Affected

ProductAffectedFixed inSource
Google Merchant Center Feed1.9.1 – 2.3.8–CNA

Scores by source

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert.pl/en/posts/2026/09/CVE-2026-85520refmypresta.eu/news/google-merchant-center-security-fix-2026.html