CVE-2022-45447

MEDIUM

Prestashop m4_pdf < 3.2.3 - Path Traversal via 'f' Parameter in /m4pdf/pdf.php

Title source: llm
STIX 2.1

Description

M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists.

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0071
EPSS Percentile 49.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
prestashop/m4_pdf < 3.2.3
Published Sep 20, 2023
Tracked Since Feb 18, 2026