PrestaShop The Firmware CVE-2026-14846

Exploitation requires the attacker to hold a high-privilege account on the PrestaShop instance (PR:H per the CVSS 4.0 vector - the exact role level, e.g., shop administrator vs. privileged merchant, is not confirmed in available data). The attacker must be able to modify the 'Alias' field in the 'Update your address' functionality of The Firmware module. A separate victim with access to the 'Get my data in CSV' export feature must actively trigger the export and open the resulting file in a spreadsheet application that auto-executes formula cells (e.g., Microsoft Excel, LibreOffice Calc). The victim's spreadsheet application security settings (Protected View, macro trust zones) significantly limit real-world execution - modern Excel default Protected View would block DDE execution on externally-downloaded files. Exploitation is therefore limited to: authenticated high-privilege attacker, manual victim interaction (export + open), and a permissive spreadsheet client configuration.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:A) encodes meaningful risk-reducing constraints: the attacker requires high privileges (PR:H), a specific attack requirement must be met (AT:P), and active user interaction is needed (UI:A - the victim must export and open the CSV file). The base score of 4.5 (Medium) reflects these constraints accurately. EPSS data is absent from the provided intelligence, and there is no KEV listing, meaning no confirmed active exploitation. The subsequent-system availability impact (SA:H) in the vendor-provided vector is notable and may reflect DDE-based payloads capable of crashing or compromising the victim's spreadsheet application. Real-world risk is further bounded by the requirement that a victim with sufficient privileges must manually trigger the CSV export and open the file locally - this is not an autonomous, server-side exploit. The attack is plausible in social engineering or insider scenarios but is not self-propagating. Missing data: EPSS score unavailable; exact nature of 'high privileges' (admin vs. privileged merchant account) is not confirmed by the reference.

An attacker with an authenticated account in the PrestaShop store navigates to 'Update your address' and sets the Alias field to a malicious formula such as '=CMD|' /C calc'!A0' or an IMPORTXML data-exfiltration expression. When a store administrator or the account owner later exports account data via 'Get my data in CSV' and opens the file in Microsoft Excel or LibreOffice Calc, the injected formula executes within the spreadsheet application, potentially reading local files or initiating outbound connections to an attacker-controlled server. No public proof-of-concept code has been identified, but the technique is well-documented for CWE-1236 and requires no specialized tooling.