CVE-2023-27639

Summary

CVE-2023-27639 is a vulnerability affecting the tshirtecommerce component 2.1.4 in PrestaShop. An attacker can craft a malicious HTTP request, targeting the ajax.php?type=svg endpoint with a forged file_name parameter. This allows the attacker to traverse directories, accessing files on the system without restriction on their extension or path. The vulnerability is significant as it can be exploited in XML-parseable files, and has already been observed in the wild in March 2023.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.