Critical severity9.8OSV Advisory· Published Nov 19, 2018· Updated Jun 17, 2026
CVE-2018-19355
CVE-2018-19355
Description
modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.php with auptype equal to product (for upload destinations under modules/productfiles), order (for upload destinations under modules/files), or cart (for upload destinations under modules/cartfiles).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*range: >=1.5.0.0,<=1.7.0.0
- cpe:2.3:a:mypresta:customer_files_upload:2018-08-01:*:*:*:*:prestashop:*:*
- Range: 2018-08-01
Patches
Vulnerability mechanics
References
1- ia-informatica.com/it/CVE-2018-19355nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.