Vulnerability · Published Sep 29, 2026 · Assigned by CERT-PL

CVE-2026-85520Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Critical 9.3

In plain English

A critical-severity security flaw in Google Merchant Center Feed from MyPresta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)1.0%top 37.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

Affected products (as reported)

Vendor	Product	Versions
MyPresta	Google Merchant Center Feed	1.9.1 – through 2.3.8

Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://cert.pl/en/posts/2026/09/CVE-2026-85520 third-party-advisory
https://mypresta.eu/news/google-merchant-center-security-fix-2026.html mitigation