What is the CVSS score of CVE-2025-25691?

CVE-2025-25691 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.8%.

Is there a public PoC exploit available for CVE-2025-25691?

Yes, a public proof-of-concept exploit is available for CVE-2025-25691. Prioritise patching immediately. EPSS: 0.8%.

PrestaShop CVE-2025-25691

MEDIUM

Command Injection (CWE-77)

2025-07-30 cve@mitre.org

Command Injection Deserialization RCE Prestashop

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Admin-only endpoint with CSRF token implies PR:H; arbitrary code execution warrants C:H/I:H/A:H, not the provided C:L/I:L/A:N.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:54 vuln.today

DescriptionCVE.org

A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

AnalysisAI

Remote code execution in PrestaShop 8.2.0 is achievable through a PHAR deserialization flaw in the theme import endpoint (/themes/import), where a crafted POST request containing a malicious PHP Archive triggers arbitrary code execution on the server. A publicly available proof-of-concept exploit exists on GitHub, lowering the technical barrier for skilled attackers. No active exploitation has been confirmed in CISA KEV, but the combination of a public POC and a targeted admin-facing endpoint warrants prompt remediation for any deployment on this version.

Technical ContextAI

The vulnerability resides in PrestaShop's theme import functionality (CPE: cpe:2.3:a:prestashop:prestashop:8.2.0:*:*:*:*:*:*:*), which accepts uploaded archive files to install custom storefront themes. PHP's PHAR (PHP Archive) stream wrapper has a well-documented behavior where it triggers PHP object deserialization automatically when a PHAR file is accessed - even through otherwise-safe file operations such as file_exists() or include() - making it a powerful deserialization gadget chain entry point. The vulnerability is classified CWE-77 (Improper Neutralization of Special Elements Used in a Command), indicating that the PHP deserialization chain ultimately results in OS-level command injection rather than purely in-process PHP object manipulation. The reference URLs in the NVD data point to a PrestaShop admin-panel path that includes a CSRF token parameter, confirming this endpoint is within the authenticated back-office of PrestaShop.

RemediationAI

No specific patched version has been independently confirmed from the available data - administrators should monitor the PrestaShop GitHub repository at https://github.com/PrestaShop/PrestaShop and official PrestaShop security channels for a released fix, and upgrade as soon as one is available. As an immediate compensating control, restrict access to the admin theme import endpoint (/admin/index.php/improve/design/themes/import) at the web server or WAF level to trusted IP addresses only, preventing external attackers from reaching the endpoint even with valid credentials. Hardening PHP to restrict PHAR stream wrapper usage (setting phar.readonly = On in php.ini and constraining open_basedir) reduces deserialization attack surface but may break legitimate theme management functionality - test in staging first. Enforce multi-factor authentication on all PrestaShop admin accounts to raise the cost of credential compromise, and audit current admin users for unauthorized access. These controls address the attack pathway but are not substitutes for applying the vendor patch.