CVE-2022-21686

Server Side Twig Template Injection in PrestaShop

State: Published
Severity: 9.0 Critical
Published: Jan 26, 2022
Updated: Apr 23, 2025
Reserved: Nov 16, 2021

Description

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
PrestaShopPrestaShop	>= 1.7.0.0, < 1.7.8.3Affected

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465
https://github.com/PrestaShop/PrestaShop/commit/d02b469ec365822e6a9f017e57f588966248bf21
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.