Loading story…
CERT Polska disclosed CVE-2026-85520, an external control of file name or path vulnerability in MyPresta Google Merchant Center Feed software. The flaw could permit unsafe handling of attacker-influenced file names or paths, creating a potential path-traversal risk.
The available disclosure does not identify affected versions, a CVSS severity score, exploitation in the wild, technical proof-of-concept details, or a vendor-provided remediation. Organizations using the MyPresta module should identify deployed instances, monitor CERT Polska and the vendor for patch guidance, and restrict access to administrative and file-handling functionality pending further details.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-85520 was published for an external-control-of-file-name-or-path flaw (CWE-73) in MyPresta Google Merchant Center Feed. The vulnerable feed.php endpoint lets unauthenticated attackers control the path, name, extension, and contents of written files, potentially enabling remote code execution.
MyPresta fixed CVE-2026-85520 in Google Merchant Center Feed version 2.3.9. The flaw affected versions 1.9.1 through 2.3.8 and allowed unauthenticated arbitrary file writes that could lead to PHP code execution.
Today Group sp. z o.o. responsibly reported the vulnerability in MyPresta’s Google Merchant Center Feed (gmfeed) module for PrestaShop. CERT Polska received the report and coordinated disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cert.pl
Open sourcecvefeed.io
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed **CVE-2026-16270**, a denial-of-service vulnerability in Open Mercato caused by **inefficient regular expression complexity** (`CWE-1333`). The flaw affects all versions before **0.6.4** and allows a privileged user to add an unsafe regular expression rule to a field, which can then consume excessive resources and disrupt service availability. The issue was reported responsibly by **Pawel Scibiorski** and coordinated through CERT Polska. Open Mercato addressed the vulnerability in version **0.6.4**, making the update the primary remediation for organizations running affected deployments.
Jul 23, 2026
A critical Magento vulnerability dubbed **PolyShell** allows unauthenticated attackers to upload arbitrary files through the platform's REST API by disguising malicious payloads as image uploads in cart item custom options. The issue affects all stable versions of **Magento Open Source** and **Adobe Commerce**, and stems from Magento writing base64-encoded file data to a server-accessible upload directory, creating a path to compromise without prior authentication. Depending on web server configuration, successful exploitation can lead to **remote code execution** or **account takeover** through stored cross-site scripting. Adobe addressed the flaw in the `2.4.9` pre-release branch under **APSB25-94**, but no standalone production patch is available, leaving current deployments exposed. Researchers at Sansec said exploit methods are already circulating and warned that automated attacks are likely, urging administrators to restrict access to the affected upload directory, verify web server protections, and scan stores for web shells or other malware.
Jun 29, 2026
CERT Polska reported two SQL injection vulnerabilities in the Alior Bank **“raty”** installment-payment module for PrestaShop. The issues are tracked as **CVE-2026-7848** and **CVE-2026-15600**. The available disclosures do not identify affected module versions, vulnerable request parameters, severity ratings, evidence of exploitation, or remediation measures. Organizations using the module should identify deployed versions and consult Alior Bank and CERT Polska advisories for fixes or mitigations.
Sep 14, 2026