CVE-2023-27639 Scanner
CVE-2023-27639 scanner - Directory Traversal vulnerability in The Custom Product Designer (tshirtecommerce) module for PrestaShop
Used 3.1k times · 5.9k assets checked · domain, ipv4, subdomain
CVE
CVE-2023-27639
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
Updated Sep 22, 2026View on NVD →
S4E scanner
Monitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →