PrestaShop 9.1.5 and 8.2.8 Released: Important Security Updates

PrestaShop has officially released PrestaShop 9.1.5 and PrestaShop 8.2.8 on August 18, 2026. Both releases include important security fixes designed to better protect store data, Back Office access, imports and exports, and visitor information.

For merchants already using the 9.1.x or 8.2.x branches, these are not updates to postpone. PrestaShop strongly recommends updating as soon as possible, especially because both versions address five recently identified security vulnerabilities.

Let’s take a closer look at what’s new and what these changes mean for your store.

What’s New in PrestaShop 9.1.5?

PrestaShop 9.1.5 is a substantial maintenance release. In addition to five security fixes, it includes close to 100 merged fixes and improvements, with no breaking changes announced for this release. It is also planned to be the final version in the PrestaShop 9.1.x line before PrestaShop 9.2.

Important security improvements

The five security issues fixed in PrestaShop 9.1.5 cover several different areas of the platform. Here is what they mean in simpler terms for store owners:

• Safer CSV exports: Certain specially crafted data in a CSV export could previously be treated as a formula when the file was opened in spreadsheet software such as Excel. This could put the person opening the exported file at risk. The update improves how exported data is handled.
• Safer image imports from CSV files: When importing data containing image URLs, the server could previously be made to connect to unintended addresses. Exploiting this issue required access to the CSV import feature in the Back Office, but the new version adds stronger protection around these requests.
• More reliable visitor IP detection: In some setups using proxies, load balancers, or CDNs, a visitor could make PrestaShop recognize a false IP address. This could affect maintenance-mode IP restrictions, logs, geolocation rules, rate limiting, or other protections that rely on IP addresses.
• Stronger protection for database information: A logged-in Back Office employee could potentially use certain list filters to access database information outside the permissions normally assigned to their account. PrestaShop 9.1.5 strengthens validation around these filters.
• Better Back Office permission checks: Information shown through Back Office notifications, including recent customer, order, or customer-service data, could previously be accessible to employees without the appropriate permissions. The affected endpoints now perform stricter permission checks.

If your store is behind a CDN, reverse proxy, or load balancer, PrestaShop also recommends checking that forwarded IP addresses are configured correctly. Updating PrestaShop fixes the application-side issue, but correct proxy configuration remains important for accurate visitor IP detection.

Better multistore and stock management

PrestaShop 9.1.5 includes several fixes for multistore environments. These improvements address issues related to stock behavior, shared available quantities, product combinations, and shop URL configuration.

For merchants managing several stores from the same PrestaShop installation, these fixes should provide more consistent stock and configuration behavior.

Improvements to products and pricing

Several long-standing product-management issues have also been corrected.

The release improves the handling of specific prices, attribute color previews, and custom feature values. These may seem like small changes individually, but together they make day-to-day product management in the Back Office more reliable.

More reliable orders and invoices

PrestaShop 9.1.5 also addresses several issues involving orders and invoices. Improvements include better handling when changing order statuses, more accurate invoice information, safer invoice filenames, and fixes related to how payment methods are displayed.

SEO and Front Office fixes

There are useful improvements for storefronts and SEO as well.

For example, the update fixes cases where meta titles could incorrectly become part of CMS, manufacturer, supplier, or CMS category URLs. It also prevents empty EAN-13 values from appearing in product URLs and improves how text is processed for the PrestaShop search index.

Overall, PrestaShop 9.1.5 is more than a security patch. It is a broad stability release that brings together many fixes made across the 9.1 branch before development moves toward PrestaShop 9.2.

Download PS 9.1.5 now

What’s New in PrestaShop 8.2.8?

PrestaShop 8.2.8 has a much more focused purpose.

Unlike PrestaShop 9.1.5, 8.2.8 is a security-only release. It contains the same five security fixes described above, including three issues rated High severity. There are no major new features included in this version.

This is expected because the PrestaShop 8.2.x branch is now in extended support, meaning it mainly receives security patches and critical fixes rather than new functionality. PrestaShop itself encourages merchants on this branch to begin planning a move toward the newer PrestaShop generation.

If your store currently runs PrestaShop 8.2.x, updating to 8.2.8 is highly recommended so your store benefits from the latest available security protections.

Download PS 8.2.8 now

Upgrade or Migrate Your PrestaShop Store

If your store is still running an older PrestaShop version, this is a good time to plan your move to a newer, more secure, and better-supported version.

If you want to upgrade your existing store while keeping its current setup, Direct Upgrade can help simplify the upgrade process.

If you prefer to move your store data to a fresh PrestaShop installation or migrate between different versions or setups, MigrationPro Ultimate gives you greater flexibility and control over the migration process.

Whichever approach you choose, we hope your PrestaShop upgrade or migration goes smoothly. If you have any questions or need assistance with our products, feel free to contact us — our team will be happy to help.