PrestaShop Debug Mode Writes Attacker-Controlled PHP Into Its Runtime Configuration
PrestaShop's Debug mode is a development convenience in the back office. It can also change how the application writes PHP configuration. CERT/CC published VU#385711 on 2026-11-09 for a PHP code injection issue in that feature. The defect matters because a value entered through the administrative interface can become executable source code loaded on later requests.
The configuration path
PrestaShop lets an administrator set a debug cookie name and value under Performance > Debug mode. The application inserts those values into a PHP expression and writes the expression into a define() statement in config/defines.inc.php or config/defines_custom.inc.php.
That design assumes both values behave as inert strings. The advisory says the application does not adequately escape or sanitize them for PHP source. A crafted value can terminate the intended string and add another PHP statement. The application then loads the modified configuration during initialization, giving the injected statement a place in the normal request lifecycle.
The attacker needs an authenticated back-office account that can modify debug mode settings. The PHP process also needs write access to the configuration file. Root access is not required. CSRF protection helps against requests created through another administrator's browser, but it does not stop an attacker who owns an account with the required permission.
Why this is more than a settings bug
The resulting code runs with the privileges of the PHP process. Those privileges usually reach application secrets, customer data, uploaded files, database credentials and writable application code. An attacker could also disrupt checkout or other store operations.
Operating system command execution depends on the PHP configuration and enabled functions. The advisory does not claim that PHP code execution automatically becomes root access, and administrators should not treat it that way. The immediate boundary is still the web application account.
This path also survives a superficial review of roles. An account may be intended only for store operations, yet inherit a configuration-capable permission by accident. Debug mode is often left enabled after troubleshooting, which keeps a development-only path inside a production administration surface.
Remediation
PrestaShop 9.2.1 fixes the issue. Administrators should inventory the running version and update affected installations to 9.2.1 or later.
When an immediate upgrade is not possible, limit Performance and Debug mode permissions to a small set of trusted administrators. Restrict access to the back office by network policy where feasible. Consider removing write access to config/defines.inc.php and config/defines_custom.inc.php for the PHP process, but test this first because the restriction may block legitimate configuration changes.
Review existing configuration files for unexpected PHP statements around the debug cookie definitions. Compare them with a known-good deployment artifact. Rotate application secrets if an account with configuration rights was compromised, because the injected code could have read environment values and application files.
The vendor advisory lists CVE-2026-124916 and identifies 9.2.1 as fixed. Organizations should record the installed version, the exposed administration addresses and the set of accounts that can change Performance settings.
Top comments (0)