PrestaShop The Firmware CVE-2026-14846

Q: What is the CVSS score of CVE-2026-14846?

CVE-2026-14846 has a CVSS 4.0 base score of 4.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43335 MEDIUM

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-07-13 INCIBE

Code Injection Prestashop The Firmware

4.5

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

4.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Attacker needs only a regular authenticated account (PR:L) to set the alias; victim interaction (UI:R) and scope change to spreadsheet application (S:C) reflect the formula-execution mechanism.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:30 vuln.today

DescriptionCVE.org

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.

AnalysisAI

CSV formula injection in the PrestaShop module 'The Firmware' version 8.2.1 enables an authenticated attacker to inject malicious spreadsheet expressions via the unsanitized 'Alias' parameter in the address update function. When a victim subsequently exports account data using the 'Get my data in CSV' feature and opens the file in a spreadsheet application, the injected formula executes in that application's context, potentially exfiltrating the victim's personal data or executing commands on their workstation. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.5 reflects the high-privilege and user-interaction prerequisites that constrain exploitability.

Technical ContextAI

This is a classic CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) flaw, also known as CSV injection or formula injection. The affected component is a PrestaShop e-commerce module identified in CPE data as 'prestashop:the_firmware' at version 8.2.1. The 'Alias' field in the address management form is written directly to CSV output without stripping or escaping leading formula trigger characters (=, +, -, @). Spreadsheet applications such as Microsoft Excel, LibreOffice Calc, and Google Sheets interpret cells beginning with these characters as executable formulas, enabling payloads including DDE (Dynamic Data Exchange) commands, IMPORTXML exfiltration calls, or shell-launching instructions depending on the victim's client application and security settings.

RemediationAI

No vendor-released patch version has been identified in the available data; the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-neutralisation-prestashop-firmware should be consulted for current patch status. As a compensating control, restrict access to the 'Get my data in CSV' export feature to trusted administrative roles only, reducing the pool of potential victims who could trigger formula execution. Input validation should be enforced server-side on the 'Alias' field to strip or reject leading formula-trigger characters (=, +, -, @, tab, carriage return) before persistence. On the client side, instruct users who must open exported CSVs to disable automatic formula execution in their spreadsheet application (e.g., enable Protected View in Excel, disable macros) - this mitigates the execution stage but does not fix the root injection flaw. Sandboxing CSV opens in a browser-based viewer (e.g., Google Sheets with macro execution disabled) rather than a desktop application is a lower-risk interim workaround.