What is the CVSS score of CVE-2025-25692?

CVE-2025-25692 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.8%.

Is there a public PoC exploit available for CVE-2025-25692?

Yes, a public proof-of-concept exploit is available for CVE-2025-25692. Prioritise patching immediately. EPSS: 0.8%.

PrestaShop CVE-2025-25692

MEDIUM

Command Injection (CWE-77)

2025-07-30 cve@mitre.org

Command Injection Deserialization RCE Prestashop

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.8 CRITICAL

Network-reachable POST endpoint, no auth required per PR:N, and stated arbitrary code execution justifies C:H/I:H/A:H over the NVD's underscored C:L/I:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:55 vuln.today

DescriptionCVE.org

A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

AnalysisAI

Unauthenticated remote code execution in PrestaShop 8.2.0 is achievable via PHAR deserialization in the _getHeaders function, triggered through a crafted POST request. The publicly available proof-of-concept lowers the bar for exploitation against unpatched storefronts. No active KEV listing exists, but the network-accessible attack surface of e-commerce deployments and the confirmed exploit code make this a meaningful priority for PrestaShop 8.2.0 operators despite a low EPSS score of 0.77%.

Technical ContextAI

PrestaShop is a PHP-based open-source e-commerce platform (CPE: cpe:2.3:a:prestashop:prestashop:8.2.0:*:*:*:*:*:*:*). The vulnerability lives in the _getHeaders function, which processes attacker-influenced input without sanitizing PHP stream wrappers. PHP's PHAR (PHP Archive) stream wrapper - triggered when a function such as file_exists(), fopen(), or similar file-operation wrappers is called on a user-supplied path prefixed with 'phar://' - causes PHP to deserialize the PHAR archive manifest, invoking magic methods (__wakeup, __destruct) on serialized objects present in the archive. This allows an attacker to plant a crafted PHAR file whose deserialized object graph triggers CWE-77 (Command Injection) gadget chains, ultimately running arbitrary OS commands. The assigned CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that the deserialization chain culminates in injected command execution rather than pure object-graph abuse, which distinguishes this from a pure CWE-502 (Deserialization of Untrusted Data) case.

RemediationAI

Upgrade PrestaShop beyond 8.2.0; the exact patched release version is not confirmed in the available reference data - operators should monitor the official PrestaShop GitHub repository at https://github.com/PrestaShop/PrestaShop and the security advisory channel for a confirmed fixed version before upgrading. Until a patch is applied, restrict POST access to administrative and API endpoints at the WAF or reverse-proxy layer to limit the blast radius, noting that this may impact legitimate storefront functionality. Disable PHP PHAR stream wrapper processing at the php.ini level by setting 'phar.readonly = On' and ensuring no calls to PHAR functions are required by the application; this may break legitimate PHAR-packaged dependencies and should be tested in staging. Input to file-handling functions should be validated against an allowlist of paths server-side as a defense-in-depth measure. The researcher's PoC is documented at https://github.com/3em0/cve_repo/blob/main/preshop/CVE-2025-25692.md and should be reviewed by defenders to inform detection rule authoring.