CVE-2025-25692 is a vulnerability in PrestaShop v8.2.0 involving PHAR deserialization within the _getHeaders function. An attacker can send a specially crafted POST request to trigger deserialization of malicious PHAR data, leading to arbitrary code execution. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-502 (Deserialization of Untrusted Data). The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact without availability impact.

Successful exploitation allows remote attackers to execute arbitrary code on the affected PrestaShop v8.2.0 system, potentially compromising confidentiality and integrity of the application environment. There is no indication of availability impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor PrestaShop vendor communications for updates. Until a fix is available, consider restricting access to the vulnerable endpoint or applying other compensating controls if feasible.