CVE-2025-61923 Overview
CVE-2025-61923 is a directory traversal vulnerability in the PrestaShop Checkout module, the official PayPal payment integration for PrestaShop. The backoffice fails to validate user-supplied input, allowing authenticated administrative users to read arbitrary files on the server. The flaw affects versions prior to 4.4.1 and 5.0.5, and is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Critical Impact
Authenticated backoffice users can disclose arbitrary files accessible to the web server process, including configuration files containing database credentials and API secrets.
Affected Products
- PrestaShop Checkout (ps_checkout) versions prior to 4.4.1 in the 4.x branch
- PrestaShop Checkout (ps_checkout) versions prior to 5.0.5 in the 5.x branch
- PrestaShop installations using the official PayPal partnership module
Discovery Timeline
- 2025-10-16 - CVE-2025-61923 published to NVD
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2025-61923
Vulnerability Analysis
The vulnerability resides in the backoffice component of the PrestaShop Checkout module. The module accepts input parameters that are passed to file-handling routines without proper sanitization or canonicalization. An attacker with backoffice privileges can supply crafted path sequences to traverse outside the intended directory and read arbitrary files.
Successful exploitation discloses file contents to the attacker over the network. The impact is limited to confidentiality; the vulnerability does not permit file modification or code execution directly. However, the disclosed files commonly include parameters.php, .env files, and other secrets that enable follow-on attacks against the PrestaShop store or its payment backend.
Root Cause
The root cause is missing input validation on file path parameters processed by the backoffice. The module does not restrict path components such as ../ sequences or absolute paths, nor does it enforce an allow-list of permitted files. This maps directly to [CWE-22], where user input flows into filesystem APIs without being constrained to an intended base directory.
Attack Vector
Exploitation requires an authenticated session with high backoffice privileges, and no user interaction is needed. The attacker issues a crafted HTTP request to the vulnerable backoffice endpoint with a traversal payload in the file parameter. The server returns the contents of the targeted file in the response. The scope change reflected in the CVSS vector indicates the disclosure can reach files outside the module's own directory context.
No public proof-of-concept is available at the time of writing. Technical details are referenced in the PrestaShop Checkout GHSA-fpxp-pfqm-x54w advisory.
Detection Methods for CVE-2025-61923
Indicators of Compromise
- HTTP requests to PrestaShop backoffice endpoints containing ../, ..%2f, or encoded traversal sequences in query or POST parameters.
- Backoffice access logs showing file-read operations originating from the ps_checkout module context.
- Unexpected read access to sensitive files such as app/config/parameters.php, /etc/passwd, or .env under the web server user.
Detection Strategies
- Review web server and PrestaShop access logs for requests referencing ps_checkout controllers paired with suspicious path characters.
- Deploy web application firewall (WAF) rules that block canonical and encoded directory traversal patterns against the /admin* backoffice path.
- Correlate administrator authentication events with subsequent anomalous file-read patterns to identify compromised or malicious backoffice accounts.
Monitoring Recommendations
- Alert on reads of secrets files (database credentials, PayPal API tokens) by the web server process outside expected application flows.
- Monitor the installed version of the ps_checkout module across stores and flag any instance below 4.4.1 or 5.0.5.
- Track backoffice login sources and investigate sessions originating from unfamiliar IP ranges or geolocations.
How to Mitigate CVE-2025-61923
Immediate Actions Required
- Upgrade PrestaShop Checkout to version 4.4.1 or 5.0.5 depending on the installed branch.
- Audit backoffice administrator accounts and rotate credentials for any account that may have been misused.
- Rotate secrets that may have been disclosed through the backoffice, including database passwords and PayPal API credentials.
Patch Information
The vulnerability is fixed in PrestaShop Checkout 4.4.1 and 5.0.5. Patch details and release notes are published in the PrestaShopCorp ps_checkout security advisory GHSA-fpxp-pfqm-x54w. Administrators should install the fixed module version through the PrestaShop module manager or by replacing the module files directly.
Workarounds
- No vendor-supplied workarounds exist; upgrading the module is the only supported remediation.
- As a compensating control, restrict backoffice access to trusted IP ranges and enforce multi-factor authentication for all administrator accounts.
- Apply WAF signatures that block directory traversal payloads targeting PrestaShop backoffice endpoints until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
