PrestaShop CVE-2025-25691

Exploitation requires an active, authenticated session in the PrestaShop admin panel with sufficient privileges to access the theme import feature (/admin/index.php/improve/design/themes/import). The reference URLs confirm a valid CSRF token tied to that admin session must accompany the POST request. Exploitation is therefore gated by obtaining admin-level credentials and a live session token - this is a critical limiting factor not reflected in the provided CVSS PR:N rating, which conflicts with the admin-only endpoint evidence and has not been resolved by vendor advisory. The vulnerability is specific to PrestaShop 8.2.0 per available CPE data; other versions have not been confirmed vulnerable. There is no evidence of exploitation against unauthenticated or default configurations.

The provided CVSS score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:N materially understates the risk and contains internal contradictions. First, the impact metrics C:L/I:L/A:N are inconsistent with the stated consequence of arbitrary code execution (RCE), which should carry C:H/I:H/A:H. Second, PR:N (no privileges required) conflicts directly with the reference URLs, which point to an admin-only endpoint (/admin/index.php/improve/design/themes/import) that requires a valid admin session and CSRF token - strongly implying PR:H is the correct metric. This CVSS discrepancy is unresolved by any vendor advisory in the provided data. The EPSS score of 0.79% (52nd percentile) reflects a below-average near-term exploitation probability despite the public POC, likely because admin credential access is a prerequisite that limits opportunistic exploitation. No CISA KEV listing means no confirmed active exploitation at time of analysis. Real-world risk is moderate-to-high for shops on version 8.2.0 where admin credentials may be compromised: the POC removes technical barriers, but the authentication requirement substantially limits mass exploitation.

An attacker who has obtained valid PrestaShop admin credentials - via phishing, credential stuffing, or prior breach - authenticates to the back-office admin panel and captures a valid CSRF token from the theme import page. The attacker then submits a crafted POST request to /themes/import containing a malicious PHAR archive designed to trigger a PHP object deserialization gadget chain; when the server processes the file, the PHAR stream wrapper deserializes attacker-controlled objects, resulting in OS command injection executed under the web server process account. A public proof-of-concept is available at https://github.com/3em0/cve_repo/blob/main/preshop/CVE-2025-25691.md, enabling attackers with moderate PHP knowledge to operationalize this attack.