CVE-2026-54159 is a critical remote code execution vulnerability affecting the ps_facetedsearch module in PrestaShop versions 3.0.0 through 4.0.4. The module's layered navigation functionality improperly validates slider filter values (e.g., price or weight ranges) extracted from request URLs. These values are stored in a serialized format within an internal filter-block cache and later deserialized using a native PHP unserialize() function without safeguards. Attackers can inject malicious serialized objects into the cache by crafting URL parameters, which are deserialized during subsequent requests, enabling arbitrary code execution. This vulnerability requires no authentication and could lead to full system compromise, data exfiltration, or service disruption. All deployments using the ps_facetedsearch module within the affected version range are at risk. Immediate mitigation requires upgrading to version 4.0.5 or later, which includes secure deserialization controls. Administrators should also review server logs for suspicious activity and apply web application firewall rules to block anomalous URL patterns until patched. The CVSS score of 10.0 underscores the urgency of remediation due to the vulnerability's exploitability and impact.