CVE-2025-61923: PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
4.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
10/16/2025
Updated
10/16/2025
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prestashop/ps_checkout | composer | < 4.4.1 | 4.4.1 |
| prestashop/ps_checkout | composer | >= 5.0.0, < 5.0.5 | 5.0.5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is a classic directory traversal issue within the PrestaShop Checkout module\
Vulnerable functions
AdminAjaxPrestashopCheckoutController::ajaxProcessGetLogsps17/controllers/admin/AdminAjaxPrestashopCheckoutController.php
The function `ajaxProcessGetLogs` in `AdminAjaxPrestashopCheckoutController` is vulnerable to directory traversal. It retrieves the 'file' parameter from the user request and uses it to construct a file path for reading log files. The initial validation using `Validate::isFileName` was insufficient to prevent path traversal attacks (e.g., using '../'). An attacker could provide a malicious filename to read arbitrary files on the server. The patch delegates the validation to the `LoggerFileReader::read` method, which implements stricter checks.
AdminAjaxPrestashopCheckoutController::ajaxProcessDownloadLogsps17/controllers/admin/AdminAjaxPrestashopCheckoutController.php
Similar to `ajaxProcessGetLogs`, the `ajaxProcessDownloadLogs` function in `AdminAjaxPrestashopCheckoutController` is also vulnerable to directory traversal. It takes a 'file' parameter from the user to download a log file. The original code had weak validation for the filename. The patch introduces a call to the new `validateFilename` method in `LoggerFileReader`, which properly sanitizes the input and prevents directory traversal.
LoggerFileReader::readinfrastructure/src/Logger/LoggerFileReader.php
The `read` function in `LoggerFileReader` was modified to accept a filename string instead of a `SplFileObject`. The older version was implicitly trusted the input came from a safe source. The new version now performs validation on the filename via the `validateParams` method, which prevents directory traversal attacks. The old version of this function was a key part of the vulnerability, as it was responsible for accessing the file system without proper validation of the path.