CVE-2026-33674: PrestaShop Improper Use of Validation Framework Vulnerability
Summary
CVE-2026-33674: PrestaShop: Improper Use of Validation Framework. Affects prestashop/prestashop across 2 version ranges.
< 8.2.5
>= 9.0.0-alpha.1, < 9.1.0
Fixed in 8.2.5 or 9.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- prestashop · Bitnami
The same CVE-2026-33674 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PrestaShop is an open-source e-commerce platform that enables users to create and manage online stores. It offers a wide range of features, including product management, payment processing, and customer relationship management. However, like any software, it can be susceptible to vulnerabilities that may compromise its security and functionality. The specific vulnerability in question relates to the improper use of its validation framework, which could potentially lead to security issues.
Vulnerability Detail
The vulnerability arises from the improper implementation of the validation framework within PrestaShop. This flaw can allow attackers to exploit the system, potentially leading to unauthorized access or manipulation of data. The technical aspects of this vulnerability are linked to how user inputs are validated, which, if not handled correctly, can lead to various security risks. The severity of this vulnerability is classified as low, with a CVSS score of 2.0, indicating that while it may not pose an immediate threat, it still requires attention to prevent potential exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.2.58.2.5composer require prestashop/prestashop:8.2.5 -
>= 9.0.0-alpha.1, < 9.1.09.1.0composer require prestashop/prestashop:9.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
In summary, CVE-2026-33674 is a low-severity vulnerability in PrestaShop due to improper use of the validation framework. Users are strongly advised to update their installations to the patched versions 8.2.5 or 9.1.0 to mitigate potential risks. Regular monitoring and updates are essential for maintaining the security of your e-commerce platform.
See every vulnerability recorded for prestashop/prestashop →
FAQ
CVE-2026-33674 is a vulnerability in PrestaShop related to the improper use of its validation framework, which could lead to security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions include all versions prior to 8.2.5 and 9.1.0. Users should upgrade to these versions to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to prioritize updating your installation to the patched versions as soon as possible to ensure security.
The CVSS score for this vulnerability is 2.0, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for prestashop/prestashop.
