CVE-2025-25691 is a vulnerability in PrestaShop v8.2.0 involving unsafe deserialization of PHAR files in the /themes/import component. An attacker can send a specially crafted POST request to trigger deserialization of malicious PHAR data, potentially leading to arbitrary code execution. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-77 (Command Injection). No known exploits in the wild have been reported, and no patch or official fix is currently documented.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, leading to potential compromise of the PrestaShop application and underlying server. The CVSS vector indicates network attack vector with low attack complexity, no privileges required, and no user interaction needed. Confidentiality and integrity impacts are low, with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the /themes/import component to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.