Medium 4.1 CVSS 3.1 ps_checkout Component: back office Published on 2025-10-16

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.

CVECVE-2025-61923 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-10-09

Description

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary

Medium 4.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredHigh

User interactionNone

ScopeChanged

ConfidentialityLow

IntegrityNone

AvailabilityNone

References

Patchgithub.com
https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-fpxp-pfqm-x54w

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: ps_checkout

All ps_checkout advisories (3)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2025-61924 PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. ps_checkout Low 3.8 < 4.4.1
≥ 5.0.0 < 5.0.5 2025-10-16 No

CVE-2025-61922 PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. ps_checkout Critical 9.1 ≥ 1.3.0 < 4.4.1
≥ 5.0.0 < 5.0.5 2025-10-16 Yes

Do you use the ps_checkout module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected