CVE-2023-27639

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.

• CWE-22
• CWE-22

• https://friends-of-presta.github.io/security-advisories/module/2023/03/30/tshirtecommerce_cwe-22.htmlExploit, Patch, Third Party Advisory
• https://friends-of-presta.github.io/security-advisories/module/2023/03/30/tshirtecommerce_cwe-22.htmlExploit, Patch, Third Party Advisory

Published

Jun 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27633Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrad…8.8
• CVE-2023-27634Cross-Site Request Forgery (CSRF) vulnerability allows arbit…8.8
• CVE-2023-27635debmany in debian-goodies 0.88.1 allows attackers to execute…7.8
• CVE-2023-27636Progress Sitefinity before 15.0.0 allows XSS by authenticate…5.4
• CVE-2023-27637An issue was discovered in the tshirtecommerce (aka Custom P…9.8
• CVE-2023-27638An issue was discovered in the tshirtecommerce (aka Custom P…9.8
• CVE-2023-2764The Draw Attention plugin for WordPress is vulnerable to una…4.3
• CVE-2023-27640An issue was discovered in the tshirtecommerce (aka Custom P…7.5
• CVE-2023-27641The REPORT (after z but before a) parameter in wa.exe in L-S…6.1
• CVE-2023-27643An issue found in POWERAMP 925-bundle-play and Poweramp 954-…7.5
• CVE-2023-27645An issue found in POWERAMP audioplayer build 925 bundle play…9.8
• CVE-2023-27647An issue found in DUALSPACE Lock Master v.2.2.4 allows a loc…7.1