What is CVE-2026-54159?
CVE-2026-54159 is a PHP object injection vulnerability in ps_facetedsearch, the layered navigation module bundled with PrestaShop, that lets an unauthenticated attacker run arbitrary code on the storefront. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).
The module rebuilds a shopper’s selected filters from the request URL. The value of a slider filter, either price or weight, is read from the URL without sufficient validation and written into an internal filter-block cache, where it is serialized. The module later reads that cached value back with a raw native unserialize() call in src/Filters/Block.php. By crafting the slider value, an attacker can smuggle a malicious serialized PHP object into the cache. When it is deserialized, a gadget chain writes an attacker-controlled PHP file into the module directory.
That file then functions as a webshell, giving the attacker command execution on the underlying server. Exploitation is remote, requires no authentication, and needs no user interaction. A visitor-facing category page with a price or weight slider is enough of an entry point.
What assets are affected by CVE-2026-54159?
The flaw affects ps_facetedsearch from version 3.0.0 up to, but not including, 4.0.4. The vulnerable code path is reachable whenever a store runs an affected module version and exposes a price or weight slider filter on its front office, which is a common default for category and search pages.
In practice, an affected asset is a public PrestaShop storefront. These sites are internet-facing by design, since a shop cannot sell without being reachable, and the vulnerable endpoint sits on ordinary category pages rather than behind an admin login. ps_facetedsearch is one of the most widely deployed PrestaShop modules and ships as a first-party component, so many merchants run it without treating it as a separate thing to track or patch.
The gap that tends to leave stores exposed is update cadence. Merchants often keep the PrestaShop core reasonably current while bundled modules drift behind, and a slider filter that has worked for years rarely prompts anyone to check its version. The result is a large population of live storefronts running an older ps_facetedsearch with the vulnerable filter enabled.
What does our data show about exposure patterns?
Among the sectors we could classify, exposure is led by Consumer Discretionary at 20.7% of observed assets, with Industrials contributing 13.8% and Communication Services 9.2%. Consumer Discretionary sitting at the top is consistent with the nature of the software: PrestaShop is an e-commerce platform, and retail, apparel, and consumer-goods brands are its core user base.
Consumer Discretionary organizations tend to run multiple storefronts across brands, regions, and campaigns, often spun up quickly and maintained unevenly. That pattern produces exactly the conditions this vulnerability rewards: many public sites, inconsistent module versions, and filter configurations copied forward without review. A single retailer can account for a spread of affected assets across several domains.
The largest slice in this set, at 56.3%, falls into Others, and most of that is made up of assets we could not tie to a clean sector classification. That distribution is itself the pattern worth noting. Exposure to this flaw does not concentrate in one industry so much as it follows PrestaShop deployment, and PrestaShop turns up across retail arms, media properties, and side storefronts that sit outside an organization’s primary line of business. Those secondary and transitional sites are the ones least likely to be inventoried, which is where forgotten module versions survive.
Are fixes available?
Yes. PrestaShop has released ps_facetedsearch version 4.0.4, which fixes the flaw, and upgrading to 4.0.4 or later is the complete remediation. The fix replaces the raw native unserialize() call with PrestaShop’s safe \Tools::unSerialize() wrapper.
For merchants who cannot upgrade immediately, the same one-line change can be applied manually to src/Filters/Block.php. This should be treated as a stopgap rather than a substitute for the upgrade, because a manual edit can be lost the next time the module is updated or reinstalled.
Because ps_facetedsearch is a bundled module rather than part of the PrestaShop core, its version is not always obvious from the platform version alone. Defenders should confirm the installed module version directly rather than assuming a recent core release includes the fix.
Are there any other recommended actions to take?
Until the upgrade is confirmed across every store, defenders should:
- Inventory all PrestaShop storefronts and record the installed ps_facetedsearch version
- Remove price and weight slider filters from front-office filter templates where possible
- Watch the ps_facetedsearch module directory for newly written or unexpected PHP files
- Review web server logs for crafted slider-filter values in category and search URLs
- Alert on outbound connections initiated by the web server that fit webshell behavior
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-54159 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
