Skip to content
Threat Feed
Subscribe

Product

Ps_facetedsearch (3.0.0 Through 4.0.3)

1 brief RSS
critical advisory

Unauthenticated PHP Object Injection in PrestaShop ps_facetedsearch Leads to RCE

An unauthenticated PHP Object Injection vulnerability, tracked as CVE-2026-54159, affects the PrestaShop ps_facetedsearch module versions 3.0.0 through 4.0.3, allowing attackers to craft malicious serialized PHP objects in URL parameters that, upon deserialization, result in arbitrary file writes and remote code execution on the server.

ps_facetedsearch php-object-injection rce webshell prestashop cve web-exploitation
1r 3t