VDB
CVE-2026-85520
CVE-2026-85520
PUBLISHED
CVSS 9.3 CRITICAL
Reported by CERT-PL · Published September 29, 2026
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.
Risk Scores
CVSS 4.0
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| MyPresta | Google Merchant Center Feed | 1.9.1 |
| MyPresta | Google Merchant Center Feed | 1.9.1 |
Timeline
- Apr 3, 2024 VulnCheck KEV Exploitation
- Sep 29, 2026 VulnCheck KEV Exploitation
- Sep 29, 2026 CVE Published
- Sep 29, 2026 VulnCheck XDB Entry
- Sep 30, 2026 EPSS Score
- Sep 30, 2026 CVE Updated
- Oct 1, 2026 VulnCheck XDB Entry
- Oct 3, 2026 EPSS Score
- Oct 7, 2026 VulnCheck KEV Exploitation
- Oct 7, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
- Oct 14, 2026 EPSS Score