ps_facetedsearch (CVE-2026-54159): how to tell if your PrestaShop store is affected
In short
Your store is affected if it runs the official ps_facetedsearch module (faceted search, the catalog filters by price, brand or attributes) in any version from 3.0.0 to 4.0.3. The flaw, CVE-2026-54159, was published on June 3, 2026 and is critical (CVSS 10): it allows running code on the server without a username or password. The fix is updating the module to 4.0.4 or later. If you cannot, the official advisory suggests removing the price and weight slider filters, clearing the filter cache and checking for new PHP files in the module folder.
Almost every PrestaShop 1.7, 8 and 9 store has ps_facetedsearch installed: it is the official module that adds the filters to catalog category pages. That is why this advisory matters more than one for some random third-party module. Here I explain which versions are affected, how to check yours and what to do if your store is old and cannot install the fixed version. I do not explain how the flaw is exploited: you do not need that to protect yourself.
By Jose SorianoLast updated: 5 min read
What happened
On June 3, 2026, the PrestaShop team published advisory GHSA-m5f5-28qr-9g9r on GitHub: a PHP object injection flaw in the ps_facetedsearch filter cache that allows running code on the server without being logged in. It has the identifier CVE-2026-54159 and the maximum severity, 10 out of 10 (CVSS 3.1). The NVD published it on July 17, 2026, and INCIBE-CERT (the incident response team of INCIBE, Spain's national cybersecurity institute) lists it in its vulnerability database.
Running code on the server is the worst thing that can happen to a store: whoever manages it can leave a backdoor, read the database with your customers and orders, or plant a script that copies card details at checkout.
Affected and fixed versions
| ps_facetedsearch version | Status | What to do |
|---|---|---|
| Before 3.0.0 | Not included in the advisory | It is a very old version: check the other advisories and plan the store upgrade |
| 3.0.0 to 4.0.3 | Affected | Update to 4.0.4 or later; if you cannot, apply the temporary measures |
| 4.0.4 | Fixed (June 3, 2026) | Nothing urgent for this flaw |
| 5.0.0 and later | Fixed | Branch for PrestaShop 8.2 and later |
Source: advisory GHSA-m5f5-28qr-9g9r and the module's releases page on GitHub, checked on October 23, 2026. Some databases, such as INCIBE's, write the range as "up to 4.0.4": 4.0.4 is the version that fixes it.
How to see which version you have
In the back office, go to Modules → Module Manager and search for "facet" or "Faceted search": you will see the installed version. From the database (replace ps_ with your table prefix):
SELECT name, version, active FROM ps_module WHERE name = 'ps_facetedsearch';If someone updated the module by uploading files over FTP, the real version is in modules/ps_facetedsearch/ps_facetedsearch.php, on the $this->version line. If the module does not appear in either place, you do not have it installed and this advisory does not affect you.
How to fix it
If your store can install 4.0.4 or later
Back up your files and database, then update the module from the Module Manager or by uploading the official ZIP from the module's releases page. Afterwards, clear the PrestaShop cache and test the filters on a category and a full purchase. On PrestaShop 8.2 and 9, install the 5.x branch, which is the current one.
If your store is still on 1.7 and cannot update the module
This is the hard case. First, check the config.xml file in the 4.0.4 ZIP to see which PrestaShop versions it says it supports, and test it on a copy of the store. If it does not work with your version, the advisory itself describes measures for the meantime:
- Remove the price and weight slider filters from the module's filter templates (in its configuration, edit each template and turn off those two filters). The flaw comes in through them.
- Clear the module's filter cache and the general PrestaShop cache.
- Apply the manual fix described in the advisory to the module's
src/Filters/Block.phpfile, if it exists in your version. It is a one-line change, but a developer should make it, and it has to be redone if you reinstall the module. - Filter at the firewall (your hosting provider's or CDN's) search requests carrying serialized PHP data, as the advisory suggests. It helps, but it does not replace the steps above.
If you do not use the catalog filters, the safest option is to uninstall the module and delete its folder. Either way, this is a patch on a store that no longer gets fixes: PrestaShop 1.7 stopped getting them when 9.0 was released. I explain it in is PrestaShop 1.7 still safe? and the jump in upgrading PrestaShop.
Check whether it has already been used
Updating closes the door, but it does not kick out anyone already inside. If your store ran an affected version since June, check at least this. The commands only read:
# PHP files in the module folder modified in the last 150 days
find modules/ps_facetedsearch -name "*.php" -mtime -150 -printf "%TY-%Tm-%Td %p\n" | sort -r
# Requests with serialized PHP objects in the URL (O: encoded as O%3A)
grep -E "O%3A[0-9]+%3A" access.log | headThe reliable way is to compare every file in modules/ps_facetedsearch/ with the official ZIP of the same version: any extra .php file, or one that does not match, is a bad sign. File dates can be faked, so do not rely on the first command alone. If you find something, treat the store as hacked: start with checkout, as I explain in what to do if your PrestaShop store is hacked.
If you would rather I do it
- Check and fix: the PrestaShop security audit (€169, excluding VAT) uses the read-only connector to list the version of every module, inactive ones included, check them against published advisories and compare each file with the original. What the audit covers, module by module, is on that page.
- If someone already got in: hacked PrestaShop cleanup costs €349, with a 90-day guarantee, and starts with checkout.
- To be on time for the next advisory: PrestaShop maintenance (€69/month, no lock-in) includes module updates with a backup first and daily file-integrity monitoring.
Sources
- ps_facetedsearch advisory GHSA-m5f5-28qr-9g9r (CVE-2026-54159, critical 10.0, versions 3.0.0 to 4.0.3, fixed in 4.0.4, published on June 3, 2026, with the temporary measures).
- ps_facetedsearch releases on GitHub (4.0.4 with the fix; 5.0.0 aligned with PrestaShop 8.2 and later).
- NVD: CVE-2026-54159 (published on July 17, 2026).
- INCIBE-CERT: CVE-2026-54159 (INCIBE is Spain's national cybersecurity institute; critical severity, 10.0).
- PrestaShop 1.7.8 in extended support (security maintenance for 1.7.8 ends with the release of PrestaShop 9.0.0).
Frequently asked questions
What is ps_facetedsearch?
It is the official PrestaShop module that adds catalog filters (by price, brand, attributes or features) to category pages. It comes with the standard installation of PrestaShop 1.7, 8 and 9, so almost every store has it.
Am I affected by CVE-2026-54159?
If you run ps_facetedsearch in any version from 3.0.0 to 4.0.3, yes. Check the version in Modules → Module Manager. With 4.0.4 or later, or without the module installed, you are not affected.
My store is on PrestaShop 1.7. Can I install the fixed version?
It depends on your exact version: check in the config.xml of the 4.0.4 ZIP which PrestaShop versions it supports and test it on a copy. If it does not work, apply the advisory's temporary measures (remove the price and weight filters, clear the cache and apply the manual fix) and plan the store upgrade.
Is it enough to disable the module?
If you do not use the filters, the safe option is to uninstall it and delete its folder. A disabled module still has its files on the server.
I had an affected version. Have I been hacked?
Not necessarily, but you need to check: look for new or modified PHP files in modules/ps_facetedsearch/ by comparing them with the original, and go through the access logs. If something turns up, treat the store as hacked and start by checking checkout.