Vulnerability in Mypresta Google Merchant Center Feed
CVE-2026-85520
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.
Published · last modified .
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/en/posts/2026/09/CVE-2026-85520 (third-party-advisory)
- mypresta.eu/news/google-merchant-center-security-fix-2026.html (mitigation)
Frequently asked questions
- What is CVE-2026-85520?
- CVE-2026-85520 is a vulnerability in Mypresta Google Merchant Center Feed, classified under External Control of File Name or Path. Published 2026-09-29.
- Is CVE-2026-85520 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.