Is CVE-2023-27639 actively exploited?

Yes. CVE-2023-27639 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-27639 be exploited remotely?

The attack vector of CVE-2023-27639 has not been classified yet.

What is the CVSS score of CVE-2023-27639?

CVE-2023-27639 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-27639

UNKNOWNCISA KEVIN THE WILD

CVE-2023-27639

Published: April 11, 2026

Official Description

An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files (without restriction on the extension and path). Only files that can be parsed in XML can be opened. This is exploited in the wild in March 2023.

NVD Source

Risk Analysis

This directory traversal vulnerability in the tshirtecommerce component for PrestaShop allows a remote attacker to open arbitrary files on the system by manipulating the file_name parameter. This could lead to the disclosure of sensitive information or further system compromise. The confirmed exploitation in the wild makes this a critical vulnerability.

This vulnerability is actively being exploited in the wild as of March 2023. Attackers can remotely exploit this flaw by sending forged HTTP requests to the /tshirtecommerce/ajax.php?type=svg endpoint.

Recommended Action

Upgrade the tshirtecommerce (Custom Product Designer) component for PrestaShop to a version beyond 2.1.4. Implement strict input validation and restrict file access to prevent directory traversal attacks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-27639 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-27639 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.