GHSA-fpxp-pfqm-x54w
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | prestashop/ps_checkout | < 4.4.1 | 4.4.1 |
| Packagist | prestashop/ps_checkout | >= 5.0.0, < 5.0.5 | 5.0.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
# Impact
Missing validation on input vulnerable to directory traversal.
# Patches
The problem has been patched in versions:
v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)
Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.
# Credits
[Léo CUNÉAZ](https://github.com/inem0o) for reportied this issue.
References
External links from the advisory. They lead to third-party sites.