PrestaShop ps_facetedsearch up to 4.0.3 Block src/Filters/Block.php unserialize deserialization

Summaryinfo

A vulnerability, which was classified as critical, has been found in PrestaShop ps_facetedsearch up to 4.0.3. This affects the function unserialize of the file src/Filters/Block.php of the component Block. This manipulation causes deserialization. This vulnerability is registered as CVE-2026-54159. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability has been found in PrestaShop ps_facetedsearch up to 4.0.3 and classified as critical. Affected by this vulnerability is the function unserialize of the file src/Filters/Block.php of the component Block. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize() in src/Filters/Block.php. By crafting that value, an unauthenticated attacker can smuggle a malicious serialized PHP object into the cache, and when it is deserialized, a gadget chain writes an arbitrary PHP file inside the modules/ps_facetedsearch/ directory, which is then used as a webshell to run commands on the server. This issue is fixed in version 4.0.4.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-54159 since 06/11/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:src/Filters/Block.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.0.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Vendor

• PrestaShop

Name

• ps_facetedsearch

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3

License

• open-source

Website

• Product: https://github.com/PrestaShop/ps_facetedsearch/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion