CVE-2026-85520 is a critical vulnerability in the MyPresta Google Merchant Center Feed module for PrestaShop, affecting versions from 1.9.1 up to 2.3.8 inclusive. The vulnerability is due to external control of file name or path (CWE-73) in the feed.php endpoint, which lacks authentication and input validation. An unauthenticated attacker can craft requests that specify arbitrary file names, paths, extensions, and content, allowing arbitrary file writes. This leads to the possibility of writing and executing arbitrary PHP code, resulting in remote code execution. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. The issue was fixed in version 2.3.9.

An unauthenticated attacker can exploit this vulnerability to write arbitrary files, including PHP code, to the server. This can lead to remote code execution, allowing full compromise of the affected system. The vulnerability affects all users running vulnerable versions of the Google Merchant Center Feed module prior to 2.3.9. There are no known exploits in the wild at this time.

Upgrade the Google Merchant Center Feed module to version 2.3.9 or later, where this vulnerability is fixed. No other mitigations are specified or required once the patch is applied.