PrestaShop Checkout Directory Traversal Vulnerability Allowing Arbitrary File Disclosure

A directory traversal vulnerability allowing arbitrary file disclosure has been identified in the PrestaShop Checkout payment module, in versions prior to 4.4.1 and 5.0.5. The issue arises from the backoffice's lack of input validation, which enables directory traversal attacks. This vulnerability has been patched in versions 4.4.1 and 5.0.5.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files on the server, potentially disclosing sensitive information.

Remediation

Users can upgrade to PrestaShop Checkout version 4.4.1 or 5.0.5 to address this vulnerability.