CVE-2026-85520 - Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Back Back to CVE browser

CRITICAL

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Published Sep 29, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.99%

Description

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE).

This issue was fixed in version 2.3.9.

Affected products

Vendor MyPresta Product Google Merchant Center Feed Default
unaffected
- Version
  1.9.1
  Status
  affected
  Constraints
  <=2.3.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MyPresta

Google Merchant Center Feed

unaffected

Version	Status	Constraints
1.9.1	affected	<=2.3.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-73

References (2)

https://cert.pl/en/posts/2026/09/CVE-2026-85520
third-party-advisory
https://mypresta.eu/news/google-merchant-center-security-fix-2026.html
mitigation

Link	Providers	Tags
https://cert.pl/en/posts/2026/09/CVE-2026-85520		third-party-advisory
https://mypresta.eu/news/google-merchant-center-security-fix-2026.html		mitigation

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner CERT-PL

Published Sep 29, 2026

Updated Sep 29, 2026

Reserved Sep 4, 2026

Link CVE-2026-85520

CISA Vulnrichment

Updated Sep 29, 2026

NVD

Status Received

Modified Sep 29, 2026

Link CVE-2026-85520

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-85520