UpHeron
All vulnerabilities

Servers and applications

CVE-2022-21686

Server Side Twig Template Injection

Severity
Critical 9.8
Published
26 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.7.8.3
Also known as
GHSA-mrq4-7ch7-2465
Sources
NVD, Project advisories (GitHub)

Description

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

Affected software

SoftwareAffected versions
PrestaShopServers and applications · cpe:a:prestashop:prestashop
  • From 1.7.0.0 up to 1.7.8.3
PrestaShopServers and applications · github:prestashop/prestashop
  • From 1.7.0.0 before 1.7.8.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21686
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21686
  • GitHub Advisory Database https://github.com/advisories/GHSA-mrq4-7ch7-2465
  • github.com https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrq4-7ch7-2465