CVE-2026-85520: PrestaShop gmfeed Module RCE Vulnerability

CVE-2026-85520 Overview

CVE-2026-85520 is an unauthenticated arbitrary file write vulnerability in the Google Merchant Center Feed (gmfeed) module for PrestaShop. The flaw resides in the feed.php endpoint, which accepts attacker-controlled parameters for output file name, path, extension, and content. Because the endpoint lacks authentication and input validation, remote attackers can write arbitrary PHP files to the web root and achieve remote code execution (RCE). The issue is tracked as an external control of file name or path weakness [CWE-73] and was fixed in version 2.3.9 of the module.

Critical Impact

Unauthenticated attackers can write and execute arbitrary PHP code on PrestaShop stores running vulnerable gmfeed versions, leading to full site compromise.

Affected Products

• PrestaShop Google Merchant Center Feed module (gmfeed) versions prior to 2.3.9
• PrestaShop storefronts with the vulnerable gmfeed module installed and reachable
• Distributions of the module obtained from MyPresta prior to the 2026 security fix

Discovery Timeline

• 2026-09-29 - CVE-2026-85520 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-85520

Vulnerability Analysis

The gmfeed module exposes a feed.php endpoint intended to generate a Google Merchant Center product feed. The endpoint reads several parameters from the incoming request and uses them to construct the output file that stores the generated feed. Attackers control the destination file name, directory path, extension, and portions of the file content through those same request parameters.

Because the endpoint performs neither authentication nor input validation, a remote attacker can direct the write operation to an arbitrary location under the web root using a .php extension. The written file is then reachable through the web server and executed by the PHP interpreter. The result is remote code execution under the privileges of the PrestaShop web application, giving the attacker access to customer data, order records, and the underlying operating system depending on hardening.

Root Cause

The root cause is external control of a file name and path [CWE-73] combined with missing authentication on a state-changing endpoint. The module trusts request parameters to determine both where output is written and what extension it receives, and it does not restrict content to a safe format such as XML or CSV.

Attack Vector

The attack vector is network-based and requires no privileges, no user interaction, and no prior foothold. An attacker sends a single crafted HTTP request to feed.php, specifying the target file path, .php extension, and PHP payload as the feed content. A follow-up HTTP request to the newly written PHP file triggers execution. Details of the parameter set and exploitation flow are documented by CERT Poland and the vendor advisory from MyPresta.

Detection Methods for CVE-2026-85520

Indicators of Compromise

• Unexpected .php files under the PrestaShop modules/gmfeed/ directory, the web root, or any writable directory owned by the web server.
• HTTP access log entries showing POST or GET requests to feed.php from unauthenticated sources with unusual query parameters controlling file name, extension, or content.
• Newly created files with recent timestamps and web-server ownership in directories not normally written to by the application.
• Outbound network connections from the PHP-FPM or web-server process to unknown hosts following requests to feed.php.

Detection Strategies

• Inventory PrestaShop installations to identify any that have the gmfeed module enabled at a version earlier than 2.3.9.
• Alert on web-server log entries where requests to feed.php include parameters referencing path traversal sequences, .php extensions, or PHP tags in the body.
• Compare file listings of the PrestaShop document root against a known-good baseline to surface unauthorized additions.

Monitoring Recommendations

• Forward web-server access logs, PHP error logs, and file-integrity events to a centralized analytics or SIEM platform for correlation.
• Monitor process creation events where the web-server user spawns shells or network utilities such as sh, bash, curl, or wget.
• Track egress connections from PrestaShop hosts to identify command-and-control traffic following successful exploitation.

How to Mitigate CVE-2026-85520

Immediate Actions Required

• Upgrade the gmfeed module to version 2.3.9 or later on every PrestaShop instance.
• Restrict access to feed.php at the reverse-proxy or web-server layer until patching is complete.
• Review the PrestaShop file system for unexpected PHP files and remove any that cannot be attributed to a legitimate module.
• Rotate administrator credentials, API keys, and database secrets if evidence of exploitation is found.

Patch Information

The vendor fixed the vulnerability in gmfeed version 2.3.9. The MyPresta advisory describes the corrected authentication and input-validation logic. Administrators should download the update from the official MyPresta channel and redeploy the module across all affected stores.

Workarounds

• Block external requests to modules/gmfeed/feed.php using web-server rules or a web application firewall until the module can be upgraded.
• Disable or uninstall the gmfeed module on stores that do not require Google Merchant Center integration.
• Enforce filesystem permissions so that the web-server user cannot create .php files outside required directories.

# Example nginx rule to block external access to the vulnerable endpoint
location ~* /modules/gmfeed/feed\.php$ {
    deny all;
    return 403;
}