CVE-2026-14846
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H
- EPSS probability
- 0.43%
- CWE
- CWE-1236
- Published
- 2026-07-13
- Last modified
- 2026-07-13
Affected products
- PrestaShop The firmware
Weakness type
Related vulnerabilities
- CVE-2026-89246 — WWBN AVideo CSV Formula Injection via myComments.download.php
- CVE-2026-86745 — Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
- CVE-2026-86742 — Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
- CVE-2026-79971 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-86257 — wger before 2.6 CSV Formula Injection via member export
- CVE-2026-9852 — A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data...
- CVE-2026-76797 — MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports
- CVE-2026-56652 — Formula Injection in dool project