Medium · 6.5 CVE-2025-25691 EUVD-2025-23177GHSA-q2m3-hjgq-x5r2

A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a …

Published Jul 30, 2025 · Updated Jul 5, 2026 · Assigned by mitre

Description

A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

References

https://github.com/PrestaShop/PrestaShop
http://dem0.com/admin/index.php/improve/design/themes/import?_token=btRUtV2Om2noliZZjeFQZhlMY3gYivjABbPOjP91L6U
https://github.com/3em0/cve_repo/blob/main/preshop/CVE-2025-25691.md