CVE-2026-14846

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.

CVSS

No CVSS.

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-neutralisation-prestashop-firmware

Configurations

No configuration.

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En la versión 8.2.1 de PrestaShop, existe una vulnerabilidad relacionada con la sanitización incorrecta de elementos, causada por una validación inadecuada del parámetro ’Alias’ en la función ’Update your address’. Esta falla permite a un atacante inyectar expresiones maliciosas que se ejecutan cuando la información es exportada utilizando la herramienta ’Get my data in CSV’. La explotación exitosa de esta vulnerabilidad podría facilitar el acceso no autorizado a los datos personales de la víctima.

Information

Published : 2026-07-13 10:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-14846

Mitre link : CVE-2026-14846

CVE.ORG link : CVE-2026-14846

JSON object : View

Products Affected

No product.

CWE

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

{"id": "CVE-2026-14846", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14846", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T14:11:32.813174Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "PrestaShop", "product": "The firmware", "versions": [{"status": "affected", "version": "8.2.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-13T10:16:26.383", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-neutralisation-prestashop-firmware", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-1236"}]}], "descriptions": [{"lang": "en", "value": "In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the \u2018Alias\u2019 parameter in the \u2018Update your address\u2019 function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the \u2018Get my data in CSV\u2019 tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim\u2019s personal data."}, {"lang": "es", "value": "En la versi\u00f3n 8.2.1 de PrestaShop, existe una vulnerabilidad relacionada con la sanitizaci\u00f3n incorrecta de elementos, causada por una validaci\u00f3n inadecuada del par\u00e1metro \u2019Alias\u2019 en la funci\u00f3n \u2019Update your address\u2019. Esta falla permite a un atacante inyectar expresiones maliciosas que se ejecutan cuando la informaci\u00f3n es exportada utilizando la herramienta \u2019Get my data in CSV\u2019. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda facilitar el acceso no autorizado a los datos personales de la v\u00edctima."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "cve-coordination@incibe.es"}