{"id":"CVE-2022-31181","aliases":["GHSA-hrgx-p36p-89q4"],"url":"https://o3.security/vulnerability/CVE-2022-31181","summary":"Remote code execution in prestashop","details":"### Impact\nEval injection possible if the shop is vulnerable to an SQL injection.\n\n### Patches\nThe problem is fixed in version 1.7.8.7\n\n### Workarounds\nDelete the MySQL Smarty cache feature by removing these lines in the file `config/smarty.config.inc.php` lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):\n```php\nif (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {\n    include _PS_CLASS_DIR_.'Smarty/SmartyCacheResourceMysql.php';\n    $smarty->caching_type = 'mysql';\n}\n```\n","published":"2022-08-01T19:30:16Z","modified":"2026-08-12T03:51:34.090133533Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.06479,"percentile":0.93315,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"prestashop/prestashop","fixedVersion":"1.7.8.7"}],"fix":{"url":"https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804","label":"PrestaShop/PrestaShop@b6d96e7"},"references":[{"type":"WEB","url":"https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31181.json"},{"type":"ADVISORY","url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hrgx-p36p-89q4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31181"},{"type":"FIX","url":"https://github.com/PrestaShop/PrestaShop/commit/b6d96e7c2a4e35a44e96ffbcdfd34439b56af804"},{"type":"PACKAGE","url":"https://github.com/PrestaShop/PrestaShop"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:34.090133533Z"}}