Sign in
Deutsch English Español Polski
Critical

Server Side Twig Template Injection

  • Disclosed: 27.01.2022
  • Updated: 11.10.2026 10:22

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package prestashop/prestashop >= 1.7.0.0, < 1.7.8.3 1.7.8.3
PrestaShop (core) prestashop/prestashop >= 1.7.0.0, < 1.7.8.3 1.7.8.3

References

CVSS score 9/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-94
Platform
Composer, PrestaShop
Package
prestashop/prestashop
Disclosed
27.01.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mrq4-7ch7-2465 - CC BY 4.0

Vulnerability history: prestashop/prestashop

All published vulnerabilities of this package (PrestaShop (core)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (32) in the archive
Total entries
32
First → latest
01.2020 05.2026
Without a fix
9
Exploited in attacks
1

Severity breakdown

  • Critical 6
  • High 8
  • Medium 17
  • Low 1

Disclosures per year

Severity:
  1. PrestaShop has a stored XSS executable in customer service view
    Critical · 9.3 CVE-2026-44212 < 8.2.6, >= 9.0.0, < 9.1.1 8.2.6, 9.1.1
  2. PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
    High · 7.6 CVE-2026-33673 >= 9.0.0-alpha.1, < 9.1.0, < 8.2.5 9.1.0, 8.2.5
  3. PrestaShop cross-site scripting via customer contact form in FO, through file upload
    Critical · 9.6 CVE-2024-34716 >= 8.1.0, < 8.1.6 8.1.6
  4. PrestaShop some attribute not escaped in Validate::isCleanHTML method
    High · 8.1 CVE-2024-21627 >= 8.0.0-beta.1, < 8.1.3, < 1.7.8.11 8.1.3, 1.7.8.11
  5. Possible XSS injection through Validate::isCleanHTML method
    High · 8.3 CVE-2023-39527 >= 8.0.0, < 8.0.5, < 1.7.8.10 no fix
  6. [CVE-2023-39529][CVE-2023-39530] path traversal: file deletion in the backoffice
    High · 6.7 CVE-2023-39525 <= 8.1.0 no fix
  7. Reading a file through path traversal & Remote Code Execution via unsafe deserialization
    Critical · 9.1 CVE-2023-39528 <= 8.1.0 no fix
  8. Chain: SQL Injection (CWE-89) and Eval Injection (CWE-95)
    Critical · 9.8 CVE-2022-31181 >= 1.6.0.10, < 1.7.8.7 1.7.8.7
  9. PrestaShop PHP Object Injection
    High · 8.8 CVE-2018-20717 < 1.7.2.5 1.7.2.5
  10. SQL filter bypass leading to arbitrary write requests using SQL Manager [DEBATE RUNNING ABOUT SCORING FROM PS CORE]
    High · 8.8 CVE-2023-30839 >= 8.0.0, < 8.0.3, < 1.7.8.8 no fix
  11. Possible XSS injection through Validate::isCleanHTML method
    High · 8.0 CVE-2023-30838 >= 8.0.0, < 8.0.3, < 1.7.8.8 no fix
  12. Server Side Twig Template Injection this entry
    Critical · 9.0 CVE-2022-21686 >= 1.7.0.0, < 1.7.8.3 1.7.8.3
  13. SQL injection in prestashop/prestashop
    High · 7.5 CVE-2021-43789 >= 1.7.5.0, < 1.7.8.2 1.7.8.2
  14. PHUnit dependancy in PrestaShop and modules allow remote arbitrary PHP code execution
    Critical · 9.8 Exploited in attacks CVE-2017-9841 < 1.7.6.0 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.