What is the CVSS score of CVE-2026-39079?

CVE-2026-39079 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PrestaShop upsshipping are affected by CVE-2026-39079?

The PrestaShop upsshipping module (all current versions through 2.4.0) exposes shipping logs and API authentication credentials to remote attackers without requiring any authentication, creating an…

How to fix or mitigate CVE-2026-39079?

Within 24 hours: Conduct inventory of all PrestaShop installations running upsshipping module version 2.4.0 or earlier; test whether /modules/upsshipping/logs/ directory is accessible over the network. Within 7 days: Deploy blocking rules via WAF or web server configuration to deny all access to /modules/upsshipping/ and /lib/UPSBaseApi.php; optionally disable the upsshipping module within PrestaShop if business requirements permit. Enable detailed access logging. Within 30 days: Contact PrestaShop for patch status; prepare decommissioning or version upgrade procedures; conduct forensic review of logs to identify any unauthorized access or credential exposure.

PrestaShop upsshipping CVE-2026-39079

EUVD-2026-30770 HIGH

Information Exposure (CWE-200)

2026-05-18 mitre

GHSA-f8mg-6wwh-9h6g

PHP Information Disclosure N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated direct HTTP access to exposed log/library paths gives PR:N/AC:L/AV:N; impact is confidentiality-only (likely credentials/PII) so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:08 vuln.today

CVE Published

May 18, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

May 18, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /modules/upsshipping/logs/, and /modules/upsshipping/lib/UPSBaseApi.php components

AnalysisAI

Sensitive information disclosure in the PrestaShop upsshipping module (all versions through at least 2.4.0) lets remote attackers read exposed data by directly requesting the /modules/upsshipping/logs/ directory and the lib/UPSBaseApi.php component. Publicly available exploit code exists (SSVC 'poc'), the flaw is unauthenticated over the network (CVSS 7.5, PR:N), and CISA's SSVC framework rates it automatable, though EPSS remains low at 0.04%. There is no evidence of active exploitation in the wild.

Technical ContextAI

The affected component is a third-party UPS carrier/shipping integration module for PrestaShop, a widely-used PHP-based open-source e-commerce platform. The vulnerability is classed as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the module ships a web-reachable logs directory (/modules/upsshipping/logs/) and a library file (lib/UPSBaseApi.php) that are served directly by the web server rather than being placed outside the web root or protected by an access-control/index guard. Because these paths are resolvable over HTTP without authentication, request/response logs or API-handling code - which for a shipping-carrier integration can contain UPS API credentials, endpoints, tracking data, addresses, or debug traces - become readable. The CPE data provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not usefully constrain the affected product beyond the description.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so upgrade guidance cannot cite a specific release - monitor the module vendor and the Esokia Labs advisory (https://labs.esokia.com/cve/cve-2026-39079/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-39079) for a fixed build. As compensating controls, block direct web access to the module's internal paths by denying HTTP requests to /modules/upsshipping/logs/ and to *.php library files under /modules/upsshipping/lib/ at the web server (e.g. an Apache/Nginx location rule returning 403), which stops log scraping with no impact on legitimate storefront checkout flows that call the module server-side. Add an index.php stub or 'Deny from all' .htaccess inside the logs directory, relocate logs outside the web root if the module permits, rotate/purge any UPS API keys or credentials that may have been exposed, and review web server access logs for prior enumeration of these paths; the main trade-off is that relocating log paths may require configuration changes the module does not natively support.