CVE-2026-39079 Details

A vulnerability allowing sensitive data exposure has been identified in the PrestaShop UPS Shipping Module (upsshipping), all versions through at least 2.4.0. This issue arises from the lack of access control on the module's logs directory, which is publicly accessible via HTTP. As a result, a remote attacker can easily retrieve XML log files containing sensitive information such as UPS API credentials, shipper account numbers, customer personal information, and merchant tax identification numbers.

No official patch is available for this vulnerability, and the vendor is defunct. The recommended course of action is to completely remove the upsshipping module from the PrestaShop installation and migrate to a maintained shipping module. After removal, any remaining XML log files should be purged, UPS API credentials should be rotated, and the activity on the UPS account should be reviewed for unauthorized shipments.