CVE-2022-21686

Server Side Twig Template Injection in PrestaShop

9.0 CriticalFix available

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.79%Up 0.8 points since Feb 8, 2022

What each source reports

CVE List Score used 9.0

Server Side Twig Template Injection in PrestaShop

Record: CVE-2022-21686
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2022-0651 9.0

Record: EUVD-2022-0651
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mrq4-7ch7-2465 9.0

Server Side Twig Template Injection

Record: GHSA-mrq4-7ch7-2465
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 9.0

Record: CVE-2022-21686
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

OSV 9.0

Server Side Twig Template Injection in PrestaShop

Record: CVE-2022-21686
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-mrq4-7ch7-2465 9.0

Server Side Twig Template Injection

Record: GHSA-mrq4-7ch7-2465
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

prestashop

Affected packages

Affected packages
Package	Affected	Fixed
`prestashop/prestashop` Packagist	1.7.0.0 to 1.7.8.2	1.7.8.3
`prestashop/prestashop` Packagist	1.7.0.0 up to 1.7.8.3, plus listed versions 1.7.0.11.7.0.21.7.0.31.7.0.41.7.0.5 Show 45 moreShow less 1.7.0.61.7.1.01.7.1.11.7.1.21.7.2.01.7.2.0-rc.1.01.7.2.11.7.2.21.7.2.31.7.2.41.7.2.51.7.3.01.7.3.11.7.3.21.7.3.31.7.3.41.7.4.01.7.4.0-beta.11.7.4.11.7.4.21.7.4.31.7.4.41.7.5.01.7.5.0-beta.11.7.5.0-rc.11.7.5.11.7.5.21.7.6.01.7.6.0-beta.11.7.6.0-rc.11.7.6.0-rc.21.7.6.11.7.6.21.7.6.31.7.6.41.7.6.51.7.6.61.7.6.71.7.6.81.7.6.91.7.7.01.7.7.0-beta.11.7.7.0-beta.21.7.7.0-rc.11.7.7.1	1.7.8.3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21686 is a critical vulnerability (CVSS 9.0) in Prestashop, published January 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. Fixed in prestashop/prestashop 1.7.8.3.

References

This page doesn't list everything

Left out here: 12 versions. The JSON record has them.