CVE-2026-39079: PrestaShop upsshipping Module Information Disclosure

CVE-2026-39079 - PrestaShop upsshipping Module Sensitive Data Leakage Vulnerability Overview This vulnerability exists in the PrestaShop UPS Shipping module ( ). Due to the absence of access control in the module's directory (lacking files and guards), attackers can directly access XML log files containing sensitive data by constructing predictable URLs without authentication. Key Causes: 1. Unprotected Directory: The directory is not configured with access restrictions and lacks files that prevent directory listing. 2. Unconditional Logging: The code unconditionally logs SOAP requests and responses within the block. Even when debugging mode is disabled, API credentials and Personally Identifiable Information (PII) are written to publicly accessible files. 3. Predictable Filenames: Log filenames are based on Unix timestamps generated by , allowing attackers to easily enumerate them. 4. No Log Rotation: The function is only triggered within specific module code paths and does not actually execute in practice, causing logs to remain indefinitely. Affected Scope Affected Component: XML files within the directory. Affected Versions: All known versions of the module (up to 2.4.9). Leaked Data: UPS API credentials (Username, Password, AccessLicenseNumber). Merchant UPS account numbers. Merchant VAT/Tax IDs. Customer Personally Identifiable Information (PII): Names, addresses, phone numbers, order numbers. Vulnerability Status: The vendor (Agence Web 360) has ceased operations, and no official patch is available. Remediation Since the vendor is unreachable, the following measures are recommended: 1. Complete Removal of the Module (Recommended) Completely uninstall the module from the PrestaShop backend. Delete the directory from the file system. Clean up residual XML log files. Rotate UPS API credentials (change the password and request a new AccessLicenseNumber). 2. Temporary Hardening (If Removal is Not Immediately Possible) Block access to the directory at the web server level. Apache (.htaccess): Nginx (server block): 3. Subsequent Actions Check UPS account activity to confirm whether unauthorized shipments have occurred. Evaluate obligations for GDPR breach notification, as customer PII has been publicly exposed.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-39079: PrestaShop upsshipping Module Information Disclosure