Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-85520 EUVD-2026-88735GHSA-mxmh-vx83-qfxg

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Published Sep 29, 2026 · Updated Sep 29, 2026 · Assigned by CERT-PL

Vendor: MyPresta Product: Google Merchant Center Feed

Description

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE).

This issue was fixed in version 2.3.9.

Affected products

VendorProductAffectedFixed
MyPresta Google Merchant Center Feed 1.9.1 – ≤ 2.3.8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • murrez/CVE-2026-85520 ★ 0 · Sep 29, 2026

    CVE-2026-85520 PoC (PoCbit) — PrestaShop MyPresta gmfeed ≤2.3.9 unauthenticated arbitrary file write via feed.php (Save to file URL) → RCE. check + exploit + mass bulk (--list -j). https://pocbit.org…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References