CVE-2025-61923 is a path traversal vulnerability classified under CWE-22, found in the PrestaShopCorp ps_checkout module, which is the official payment integration for PrestaShop in partnership with PayPal. The vulnerability exists in versions prior to 4.4.1 and between 5.0.0 and 5.0.5 due to insufficient validation of input parameters in the backoffice interface. This lack of proper input sanitization allows an authenticated user with high privileges to manipulate file path parameters to access files outside the intended directory scope. The vulnerability enables arbitrary file disclosure, potentially exposing sensitive configuration files, credentials, or other confidential data stored on the server. The CVSS v3.1 score of 4.1 reflects a medium severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability does not impact integrity or availability but compromises confidentiality. No known exploits have been reported in the wild, and no workarounds exist aside from patching. The issue is resolved in versions 4.4.1 and 5.0.5 by implementing proper input validation and path restrictions. Organizations using affected versions should upgrade promptly to mitigate risk.

For European organizations, the primary impact of CVE-2025-61923 is the potential unauthorized disclosure of sensitive files from the server hosting the PrestaShopCheckout module. This could include payment configurations, API keys, customer data, or internal system files, leading to confidentiality breaches. Such data exposure could facilitate further attacks, including fraud or targeted phishing. Although the vulnerability requires authenticated access with high privileges, insider threats or compromised administrative accounts could exploit it. The impact is particularly significant for e-commerce businesses relying on PrestaShop, as payment data confidentiality is critical for compliance with GDPR and PCI-DSS regulations. Failure to address this vulnerability could result in regulatory penalties, reputational damage, and financial losses. The lack of known exploits reduces immediate risk, but the public disclosure increases the likelihood of future exploitation attempts.

The definitive mitigation for CVE-2025-61923 is to upgrade the ps_checkout module to version 4.4.1 or 5.0.5 or later, where the vulnerability has been fixed. Organizations should verify their PrestaShopCheckout version and apply updates promptly. Additionally, restrict backoffice access strictly to trusted administrators using strong authentication mechanisms such as multi-factor authentication (MFA). Implement network segmentation and firewall rules to limit access to the backoffice interface from trusted IP addresses only. Regularly audit user privileges to ensure that only necessary personnel have high-level access. Monitor logs for unusual file access patterns that could indicate exploitation attempts. Since no workarounds exist, patching combined with access controls is essential. Finally, ensure backups of critical data are maintained securely to recover from any potential data compromise.