CVE-2024-26129: 
PHP vulnerability analysis and mitigation

PrestaShop, an open-source e-commerce platform, was found to contain a path disclosure vulnerability in a JavaScript variable (CVE-2024-26129). The vulnerability affects versions from 8.1.0 through 8.1.3, with a patch available in version 8.1.4. This security issue was discovered and reported by hugo-fasone (GitHub Advisory).

The vulnerability is classified with a CVSS v3.1 base score of 5.3 (Medium) according to NVD, while GitHub rates it at 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. The issue is categorized as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and allows for path disclosure through a JavaScript variable (NVD).

The vulnerability could lead to the disclosure of system path information, which may reveal sensitive details about the server's directory structure. This information could potentially be leveraged by attackers to gain insights into the server configuration and could be combined with other vulnerabilities for more sophisticated attacks (OWASP).

The vulnerability has been patched in PrestaShop version 8.1.4. Users are advised to upgrade to this version or later to mitigate the risk (GitHub Advisory).