PrestaShop's back-office Performance > Debug mode has a PHP code injection vulnerability. An authenticated attacker can inject malicious PHP code through crafted cookie configuration values. These values are written into an executable PHP configuration file, leading to arbitrary code execution. The vulnerability stems from inadequate escaping of user-controlled debug_cookie_name and debug_cookie_value. Exploitation requires an authenticated back-office account with debug mode modification permissions and a writable configuration file. The injected code executes with the privileges of the PHP process, not requiring root access. This could allow access to secrets, customer data, file modification, and disruption of store operations. Operating-system command execution depends on PHP configuration. PrestaShop version 9.2.1 addresses this issue. Administrators should upgrade to version 9.2.1 or later. If upgrading immediately is not possible, restrict access to Performance and Debug mode settings to trusted administrators. Additionally, limit network access to the back office and prevent the PHP process from writing to config/defines.inc.php and config/defines_custom.inc.php.