CVE-2024-34716: PrestaShop customer-thread file upload XSS enables admin session theft

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe vulnerability allows unauthenticated upload leading to admin session compromise, and the very high EPSS score indicates likely exploitation despite the medium CVSS rating.

What it is

PrestaShop versions 8.1.0 through 8.1.5 with the customer-thread feature flag enabled allow an unauthenticated attacker to upload a file containing cross-site scripting through the front-office contact form. When an administrator opens the attachment in the back office, the script executes and can read the session and security token, letting the attacker act with the administrator's privileges. The flaw is patched in 8.1.6.

Impact

An attacker gains the administrator's session and security token, enabling any authenticated action within the admin's rights, including full control of the store. This can lead to data theft, defacement, or further compromise of the e-commerce platform.

Attack surface

Reached remotely over the network through the front-office contact form when the customer-thread feature flag is enabled; no authentication is required for the upload, but the victim administrator must open the malicious attachment, so user interaction is needed.

Exploitation

Not listed in CISA KEV and no public exploit tags appear in the references, but EPSS is 0.56445 (99th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

• Upgrade PrestaShop to 8.1.6 or later immediately.
• If immediate patching is not possible, disable the customer-thread feature flag as a temporary workaround.
• Restrict or monitor file uploads through the front-office contact form until the patch is applied.
• Review administrator accounts and sessions for signs of unauthorized activity after any suspected exposure.

Detection

• Monitor web server and application logs for file uploads via the contact form that contain script content or unusual file types.
• Alert on administrator sessions performing actions from unexpected IP addresses or user agents shortly after opening contact-form attachments.
• Search for anomalous or unexpected files in upload directories associated with customer threads.
• Review back-office access logs for suspicious admin actions following contact-form submissions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.