ESLog inGet started free
Critical 9.6 CVSS 3.1 Core Published on 2024-05-14

XSS via customer contact form in FO, through file upload

CVECVE-2024-34716 GHSAGHSA-45vm-3j38-7p78
View at the source View JSON Last modified at the source: 2026-06-17

Description

XSS via customer contact form in FO, through file upload

Impact

Only PrestaShops with customer-thread feature flag enabled are impacted, starting from PrestaShop 8.1.0.

The impact is substantial, when the customer thread feature flag is enabled, through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office.

Consequence: the script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right.

Patches

This vulnerability is patched in 8.1.6.

Workarounds

As long as you have not upgraded to 8.1.6, a simple workaround is to disable the customer-thread feature-flag.

Thank you to Ayoub AIT ELMOKHTAR, who discovered this vulnerability and share it with the PrestaShop team.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary
Critical 9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vectorNetwork
ComplexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same component: PrestaShop core
All core advisories (94)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows… Core Medium 6.9 ≥ 8.0.0 < 8.2.8
≥ 9.0.0 < 9.1.5 2026-09-07 No
GHSA-jf3w-9rmr-5rcr Improper access control on the back-office notifications endpoint exposes customer data Core Medium 4.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Core Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-2cr4-vw9p-pjvf Client IP address can be spoofed through the X-Forwarded-For header Core High 7.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

Is your shop on 8.x ≥ 8.1.0 < 8.1.6?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected