CVE-2026-33674
LOWVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | Despite the CVSS score of 2.0, this vulnerability presents minimal real-world risk when analyzed holistically. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) indicates network accessibility but requires high privileges, high attack complexity, and user interaction—factors that severely constrain exploitability. The impact is limited to low integrity violations with no confidentiality or availability impact. No KEV (Known Exploited Vulnerability) status or active exploitation has been reported. The lack of a public proof-of-concept, combined with the high barriers to exploitation, suggests this is a low-priority vulnerability suitable for standard patch management cycles rather than emergency response. From an SSVC perspective, this represents a low exploitation probability with minimal technical impact. |
| Exploit ScenarioDerived | An attacker with administrative or high-privilege access could potentially manipulate validation framework logic through carefully crafted requests combined with user interaction to bypass integrity checks and modify specific data fields or integrity constraints within the PrestaShop application. However, the requirement for high privileges, elevated attack complexity, and user interaction makes this a low-probability attack scenario in practice, likely exploitable only in insider threat scenarios or compromised administrative accounts rather than external attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
PrestaShop versions prior to 8.2.5 and 9.1.0 contain an improper use of validation framework vulnerability that allows information disclosure through integrity violations. An attacker with high privileges and user interaction can potentially bypass validation controls to access or modify sensitive information. The vulnerability has a low CVSS score of 2.0 reflecting limited real-world impact, though it represents a validation framework weakness in a widely-deployed e-commerce platform.
RemediationAI
Upgrade PrestaShop to version 8.2.5 or later for the 8.x branch, or to version 9.1.0 or later for the 9.x branch. Administrators should prioritize this update as part of routine maintenance cycles, though it does not require emergency patching. No workarounds are available according to the vendor advisory, so patching is the only remediation path. Review the official security advisory at https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-283w-xf3q-788v for additional guidance and to verify compatibility with any custom extensions before deployment.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability (CWE-1173: Improper Use of Validation Framework) stems from improper implementation of PrestaShop's validation framework, which is responsible for enforcing business logic and data integrity controls in the application. The affected product is PrestaShop (composer package: prestashop/prestashop), a popular open-source e-commerce platform used by thousands of online merchants. CWE-1173 indicates that the validation framework was either bypassed, incorrectly applied, or failed to enforce necessary security checks on input or state transitions. This weakness is particularly significant in e-commerce systems where validation frameworks protect against unauthorized data manipulation and unauthorized information access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
Fix improper use of validation framework
Patches
Patched in 8.2.5 and 9.1.0
Workarounds
None
References
none
Executive ViewAI
CVE-2026-33674 is a low-severity vulnerability (CVSS 2.0). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB