Description
The ESI controller of the LiteSpeed Cache module (litespeedcache) handles public requests with no login, and up to version 1.6.1 it did not check that each fragment's parameters had been generated by the store itself. Anyone tampering with them can choose the template Smarty renders and the module method that runs, which opens the door to running code on the server.
Version 1.6.2, released by LiteSpeed on 30 October 2026 as an emergency security update, signs those parameters with a key specific to each installation, ignores values sent by POST and filters out invalid templates and methods.
Exploitation
Attacks on stores running 1.6.1 have been publicly reported: unauthorised administrator accounts, malicious PHP files and modules installed without permission. LiteSpeed has not confirmed these reports.
What to do
1. Update the module to 1.6.2 or later. 2. Updating does not clean a store that is already compromised. Check employees, recently installed modules and any PHP files you don't recognise. 3. If you find anything, treat the store as compromised: remove what was added, close back office sessions and change passwords.
About this entry
No CVE or GHSA has been published. PSV-2026-0001 is PrestaShield's own reference, and the CVSS score is our own estimate based on the patch, without reproducing the flaw. The affected code has been present since at least 1.2.7; all versions before 1.6.2 are considered affected.
Original text by GitHub Security Advisory, licenseCC BY 4.0.
References
Found a vulnerability?
Write to the PrestaShop core security team:
security-core@prestashop.com