CVE-2025-61923 – PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

CVE ID : CVE-2025-61923

Published : Oct. 16, 2025, 6:15 p.m. | 25 minutes ago

Description : PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Severity: 4.1 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…