CVE-2026-54159: PrestaShop ps_facetedsearch RCE Vulnerability

CVE-2026-54159 Overview

CVE-2026-54159 is an insecure deserialization vulnerability in the PrestaShop ps_facetedsearch module, which provides layered navigation filters for PrestaShop storefronts. Versions from 3.0.0 through 4.0.3 accept slider filter values (price or weight) from the request URL without sufficient validation. The module stores those values in an internal filter-block cache, then reads them back with a raw native unserialize() call in src/Filters/Block.php. An unauthenticated remote attacker can smuggle a crafted serialized PHP object into the cache and trigger a gadget chain that writes an arbitrary PHP file into the modules/ps_facetedsearch/ directory. That file is then used as a webshell to execute commands on the server. The issue is fixed in version 4.0.4.

Critical Impact
Unauthenticated attackers can achieve remote code execution on PrestaShop stores running vulnerable ps_facetedsearch versions by planting a webshell through a PHP object injection gadget chain.

Affected Products

PrestaShop ps_facetedsearch module versions 3.0.0 through 4.0.3
PrestaShop storefronts using layered navigation filters with vulnerable module versions
Fixed in ps_facetedsearch version 4.0.4

Discovery Timeline

2026-07-17 - CVE-2026-54159 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54159

Vulnerability Analysis

The ps_facetedsearch module rebuilds selected search filters from query string parameters on each request. Slider filters, used for price and weight ranges, accept numeric bounds directly from the URL. The module places these values into a filter-block cache that is serialized to storage. When a subsequent request touches the same cache entry, the module calls native PHP unserialize() on the stored payload inside src/Filters/Block.php. Because attacker-controlled URL data flows into the cached blob, an attacker can inject a serialized PHP object rather than a numeric value. On deserialization, existing classes reachable in the PrestaShop runtime form a gadget chain that ends in writing attacker-supplied PHP source to a file under modules/ps_facetedsearch/. The written file becomes a webshell reachable over HTTP, giving the attacker command execution under the web server account. This vulnerability is classified as [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Root Cause

The root cause is the combination of insufficient input validation on slider filter parameters and the use of native unserialize() on data whose provenance includes untrusted input. Slider bounds are cached and later reconstructed without type enforcement, and the deserialization step trusts any object graph present in the cached string.

Attack Vector

An unauthenticated attacker crafts a request to a storefront category page with a slider filter parameter containing a serialized PHP object payload. The payload enters the filter-block cache and is deserialized on a subsequent request. The gadget chain writes a PHP file into modules/ps_facetedsearch/, which the attacker then requests directly to execute arbitrary commands.

php

// Security patch in src/Filters/Block.php - imports Tools helper for value sanitization
 use PrestaShop\PrestaShop\Core\Localization\Specification\NumberSymbolList;
 use PrestaShop\PrestaShop\Core\Product\Search\ProductSearchQuery;
 use PrestaShopDatabaseException;
+use Tools;

 /**
  * Display filters block on navigation
// Source: https://github.com/PrestaShop/ps_facetedsearch/commit/9ca839fac68a60641d8187a3ff9730ab09af33cb

The patch introduces the Tools helper in src/Filters/Block.php so that slider values are coerced and sanitized before entering the cache path, breaking the attacker-controlled input flow into unserialize().

Detection Methods for CVE-2026-54159

Indicators of Compromise

Unexpected .php files present in the modules/ps_facetedsearch/ directory that are not part of the shipped module release
HTTP requests to category or search URLs containing serialized PHP markers such as O: or a: inside slider filter parameters
Web server process spawning shell interpreters (/bin/sh, bash, cmd.exe) following requests to ps_facetedsearch files
Outbound network connections initiated by the PHP-FPM or web server user shortly after faceted search requests

Detection Strategies

Compare the on-disk contents of modules/ps_facetedsearch/ against the official 4.0.4 release manifest and alert on any additional PHP files
Inspect web access logs for slider parameters (for example price[ or weight[) whose values contain characters typical of PHP serialization such as :, {, and } combined with class names
Monitor for direct HTTP GET or POST requests to newly created files under modules/ps_facetedsearch/

Monitoring Recommendations

Enable file integrity monitoring on the entire modules/ tree of PrestaShop installations
Forward web server access logs and PHP error logs to a centralized analytics platform and alert on process creation events from the web server user
Track the running version of ps_facetedsearch across all PrestaShop instances and flag any version prior to 4.0.4

How to Mitigate CVE-2026-54159

Immediate Actions Required

Upgrade ps_facetedsearch to version 4.0.4 or later on every PrestaShop instance
Audit modules/ps_facetedsearch/ for unauthorized PHP files and remove any that are not part of the official release
Rotate PrestaShop admin credentials, API keys, and any secrets accessible to the web server user if compromise is suspected
Review web server access logs for slider filter parameters carrying serialized PHP payloads since the module was installed

Patch Information

The fix is available in ps_facetedsearch version 4.0.4. See the GitHub Release Version 4.0.4, the GitHub Commit Update, and the GitHub Security Advisory GHSA-m5f5-28qr-9g9r for full details.

Workarounds

Disable the ps_facetedsearch module until patching is complete if immediate upgrade is not possible
Deploy a web application firewall rule that blocks slider filter parameters containing PHP serialization tokens such as O: followed by a digit and a quoted class name
Restrict write permissions on modules/ps_facetedsearch/ so the web server user cannot create new PHP files

bash

# Upgrade ps_facetedsearch to the patched release
cd /path/to/prestashop/modules
rm -rf ps_facetedsearch
curl -L -o ps_facetedsearch.zip \
  https://github.com/PrestaShop/ps_facetedsearch/releases/download/v4.0.4/ps_facetedsearch.zip
unzip ps_facetedsearch.zip
chown -R www-data:www-data ps_facetedsearch
chmod -R a-w ps_facetedsearch
# Clear the PrestaShop cache to purge any poisoned filter-block entries
rm -rf /path/to/prestashop/var/cache/*