{"kind": "product", "path": "vulns/packagist/shopware%2Fcore", "name": "shopware/core", "product": "shopware/core", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-48012", "noindex": false, "published": "2026-07-23T19:16:38.956Z", "modified": "2026-07-24T13:31:43.099Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48012", "title": "Shopware SSO referer trust leading to an arbitrary redirect target", "description": "Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the server does not restrict that fallback target to same-origin URLs, does not require a relative path, and does not reject dangerous schemes such as `javascript:`. As a result, an unauthenticated request can turn this endpoint into a reusable redirect primitive whose destination ", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-4x3x-869w-xx3m", "https://github.com/shopware/shopware/releases/tag/v6.7.10.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-48012"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48013", "noindex": false, "published": "2026-07-23T19:14:32.579Z", "modified": "2026-07-23T19:27:54.530Z", "cvss": 4.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00366, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48013", "title": "Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel `uploadFromURL` flow validates target IPs against private/reserved ranges via `FileUrlValidator`, the `linkURL` flow only performs a URL format check (regex for `http://` or `https://` prefix), allowing SSRF to internal network services and cloud metadata endpoints. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-gq96-5pfx-f4vc", "https://github.com/shopware/shopware/releases/tag/v6.6.10.18", "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"], "fixes": ["6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48009", "noindex": false, "published": "2026-07-17T17:58:15.568Z", "modified": "2026-07-17T19:08:02.871Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00457, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48009", "title": "Shopware: Admin Account Takeover via User Recovery Hash Exposure", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST /api/_action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PATCH /api/_action/user/user-recovery/password; the root cause is that src/Core/System/User/Recovery/UserRecoveryDefinition.php exposes the hash field through the Admin API without ApiAware(false) or ReadProtection. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-8v9p-g828-v98f", "https://github.com/shopware/shopware/commit/06f8b9aa4fecb239a2ff33a6546192d7ce7ed0f8", "https://github.com/shopware/shopware/commit/9ef4873f810e26fb38da051624f7f2720139279a"], "fixes": ["6.6.10.18", "6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48014", "noindex": false, "published": "2026-07-17T17:56:43.236Z", "modified": "2026-07-21T01:48:04.992Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00389, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48014", "title": "Shopware: Admin API ACL Bypass in Order State Transition Endpoints", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or perform an explicit privilege check, so AclAnnotationValidator exits when route ACL metadata is absent and low-privileged users without order:update, order_transaction:update, or order_delivery:update can trigger StateMachineRegistry::transition() writes in SYSTEM_SCOPE. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-f8q6-3g5w-jjr6", "https://github.com/shopware/shopware/commit/86dff24ba500e16325742e59d20357f57a79c2af", "https://github.com/shopware/shopware/commit/9f15faee704b61e8a96657024fa96c70b47ad082"], "fixes": ["6.6.10.18", "6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48010", "noindex": false, "published": "2026-07-17T17:55:25.722Z", "modified": "2026-07-17T23:15:41.762Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00472, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48010", "title": "Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7", "https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d", "https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25"], "fixes": ["6.6.10.18", "6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48016", "noindex": false, "published": "2026-07-17T17:54:21.990Z", "modified": "2026-07-20T19:27:17.356Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00414, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48016", "title": "Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected ownership model. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-9v5m-39wh-5chq", "https://github.com/shopware/shopware/commit/69dd5b6cb01d3c2aea49ac29dd4512a87836ac3f", "https://github.com/shopware/shopware/commit/df15f2e607dcf9ebc4a26ec622ffcf452dc25090"], "fixes": ["6.6.10.18", "6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48015", "noindex": false, "published": "2026-07-17T17:53:01.695Z", "modified": "2026-07-17T18:11:57.809Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00485, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48015", "title": "Shopware: Stored XSS via SVG file upload — no SVG sanitization", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, <script>, and <foreignObject> to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc", "https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497", "https://github.com/shopware/shopware/commit/fd6d39bdb62dfa06fe62c7c87b37607d84094cda"], "fixes": ["6.6.10.18", "6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48008", "noindex": false, "published": "2026-07-17T17:47:27.906Z", "modified": "2026-07-17T19:47:56.823Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00472, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48008", "title": "Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass", "description": "Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-gv8p-48fr-4fxg", "https://github.com/shopware/shopware/commit/1e047f6d7fd9129271e28c1c9f1c272983c6f48f", "https://github.com/shopware/shopware/commit/db5adff33ec30b648979cd1938c87f164f7b3073"], "fixes": ["6.6.10.18", "6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48011", "noindex": false, "published": "2026-06-10T20:07:02.345Z", "modified": "2026-06-11T14:26:36.286Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00223, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48011", "title": "Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames", "description": "Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw", "https://github.com/shopware/shopware/releases/tag/v6.6.10.18", "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"], "fixes": ["6.6.10.18", "6.7.10.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-31889", "noindex": false, "published": "2026-03-11T18:56:23.171Z", "modified": "2026-03-12T20:04:11.623Z", "cvss": 8.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", "severity": "high", "epss": 0.00272, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-31889", "title": "Shopware has a potential take over of app credentials", "description": "Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the shop-url could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret. By abusing app re‑registrati", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-c4p7-rwrg-pf6p", "https://nvd.nist.gov/vuln/detail/CVE-2026-31889"], "fixes": ["6.6.10.15", "6.7.8.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-31888", "noindex": false, "published": "2026-03-11T18:53:03.018Z", "modified": "2026-03-12T20:02:47.581Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00226, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-31888", "title": "Shopware has user enumeration via distinct error codes on Store API login endpoint", "description": "Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error codes depending on whether the submitted email address belongs to a registered customer (CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS) or is unknown (CHECKOUT__CUSTOMER_NOT_FOUND). The \"not found\" response also echoes the probed email address. This allows an unauthenticated attacker to enumerate valid customer accounts. The storefront login controller correctly unifies both error paths, but the Store API does not — indicating an inconsistent defense. This vulnerability is fixed in 6.7.8.1 and 6", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-gqc5-xv7m-gcjq", "https://nvd.nist.gov/vuln/detail/CVE-2026-31888"], "fixes": ["6.6.10.15", "6.7.8.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-31887", "noindex": false, "published": "2026-03-11T18:49:46.294Z", "modified": "2026-03-12T20:02:14.866Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "high", "epss": 0.00241, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-31887", "title": "Shopware unauthenticated data extraction possible through store-api.order endpoint", "description": "Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-7vvp-j573-5584", "https://nvd.nist.gov/vuln/detail/CVE-2026-31887"], "fixes": ["6.6.10.15", "6.7.8.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-23498", "noindex": false, "published": "2026-01-14T18:31:19.070Z", "modified": "2026-01-14T21:15:57.391Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00442, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-23498", "title": "Shopware Improper Control of Generation of Code in Twig rendered views", "description": "Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf", "https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475", "https://nvd.nist.gov/vuln/detail/CVE-2026-23498"], "fixes": ["6.7.6.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-2w46-vq8h-98vh", "noindex": false, "published": "2025-11-14T20:42:24Z", "modified": "2026-09-10T03:50:30.406257620Z", "cvss": 5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-2w46-vq8h-98vh", "title": "Shopware 6's password recovery link does not expire after email change", "description": "### Summary\nWhen a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.\n\n### PoC\n\n1. Log in to a Shopware account.\n2. Request a password reset for your current email address.\n3. Copy the password reset link but do not open it.\n4. Log back into your account.n\n5. Navigate to Account Settings → Email and change your email address.\n6. Use the previously copied reset link (from before the email change).\n7. The s", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-2w46-vq8h-98vh", "https://github.com/shopware/shopware/commit/1338dd9a11e361639704bf8f09b6878552eb8c13", "https://github.com/shopware/shopware/commit/2fb94855696a90045b81c503d216ba7df8e64e52"], "fixes": ["6.6.10.9", "6.7.4.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-r2vg-hvjm-fg38", "noindex": false, "published": "2025-10-21T18:03:27Z", "modified": "2026-09-10T03:50:30.221774498Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-r2vg-hvjm-fg38", "title": "Shopware Customer Orders can be canceled, even if refunds are disabled", "description": "Refunds in general can be enabled through the administration setting `core.cart.enableOrderRefunds` (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):\nhttps://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98\nhttps://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php\n\nTo mitigate this, a check should be added to the `CancelOrderRoute` which verifies that the feature is enabled.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-r2vg-hvjm-fg38", "https://github.com/shopware/shopware/commit/b157508aef2c820e7ff89ebd5848d3019f22b592", "https://github.com/shopware/shopware"], "fixes": ["6.6.10.7", "6.7.3.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-27c9-vp3w-6ww8", "noindex": false, "published": "2025-10-21T18:03:16Z", "modified": "2026-09-10T03:50:29.009483300Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-27c9-vp3w-6ww8", "title": "Shopware exposes sensitive user information via CSV export mapping", "description": "### Impact\nMalicious actors can exploit this finding to export sensitive customer information from a Shopware application, including password hashes and password reset tokens. In SaaS deployments, this primarily affects customer accounts. In on-premise deployments, however, it also includes the hashes and recovery tokens of administrator-level accounts, which increases\nthe potential impact. \nThis risk is noteworthy because users may reuse the same or similar passwords across different services. In such cases, exposed hashes could allow attackers to recover credentials that might also be valid outside of Shopware.\n\n#### Description\nSensitive i", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-27c9-vp3w-6ww8", "https://github.com/shopware/shopware/commit/c2c98050aff7b90fe7232f6dac9b6b7143183083", "https://github.com/shopware/shopware"], "fixes": ["6.6.10.7", "6.7.3.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-3cpp-fv95-mpr5", "noindex": false, "published": "2025-10-21T18:02:52Z", "modified": "2026-09-10T03:50:29.214110928Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-3cpp-fv95-mpr5", "title": "Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice", "description": "### Impact\nThis vulnerability allows malicious actors to force the application server to send HTTP requests to both external and internal servers. In certain cases, this may lead to access to internal resources such as databases, file systems, or other services that are not supposed to be directly accessible from the internet.\n\nThe overall impact of this vulnerability is considered limited, as the functionality is highly restricted and only processes IMG tags.\n\n#### Description\nServer-Side Request Forgery (SSRF) is a vulnerability that enables a malicious actor to manipulate an application server into performing HTTP requests to arbitrary dom", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-3cpp-fv95-mpr5", "https://github.com/shopware/shopware/commit/f32737b34798d4800b81c67efee17905380d2be4", "https://github.com/shopware/shopware"], "fixes": ["6.6.10.7", "6.7.3.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-6wh5-mw9h-5c3w", "noindex": false, "published": "2025-10-21T18:02:14Z", "modified": "2026-09-10T03:50:29.497503099Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-6wh5-mw9h-5c3w", "title": "Shopware vulnerable to path traversal via Plugin upload", "description": "### Impact\nMalicious actors can exploit this vulnerability to write files within arbitrary directories on the filesystem of the Shopware web container. This could allow them to gain persistent shell access by uploading a PHP-shell file to an accessible folder.\n\nIt is important to note that this vulnerability is only present on on-premises installation of Shopware and not present on the SaaS installation due to additional security checks being implemented on the uploaded plugin files.\n\n#### Description\nA path traversal vulnerability allows malicious actors to access files and folders that are outside the folder structure accessible to the affe", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-6wh5-mw9h-5c3w", "https://github.com/shopware/shopware/commit/0965b35a527756faab2cec5a4ff172d79b0f99be", "https://github.com/shopware/shopware"], "fixes": ["6.6.10.7", "6.7.3.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-m895-2hj3-8cg9", "noindex": false, "published": "2025-10-21T18:02:01Z", "modified": "2026-09-10T03:50:30.119964648Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-m895-2hj3-8cg9", "title": "Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually", "description": "In Shopware core and platform versions before 6.6.10.7 and 6.7.3.1, media visibility restrictions applied by MediaVisibilityRestrictionSubscriber are not enforced for aggregation API requests. Authorization filters are only injected during standard entity reads; aggregation queries can be constructed to bypass these checks and enumerate private media records such as invoices or other restricted documents. A low‑privilege backend user (e.g., product editor) can chain normal business flows (creating or viewing orders) with aggregation queries to disclose sensitive customer data including addresses and payment-related information contained withi", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-m895-2hj3-8cg9", "https://github.com/shopware/shopware/commit/0965b35a527756faab2cec5a4ff172d79b0f99be", "https://github.com/shopware/shopware"], "fixes": ["6.6.10.7", "6.7.3.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}, {"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-9v82-vcjx-m76j", "noindex": false, "published": "2025-09-10T20:46:20Z", "modified": "2025-09-10T21:04:26.017198Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-9v82-vcjx-m76j", "title": "Shopware: Reflective Cross Site-Scripting (XSS) in CMS components", "description": "### Impact\nBy exploiting XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. \n\nSome examples of this include, but are not limited to:\n- Obtaining user session tokens.\n- Performing administrative actions (when an administrative user is affected).\n\nThese vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.\n\n#### Description\nWhen an application uses input f", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-9v82-vcjx-m76j", "https://github.com/shopware/shopware/commit/12fb537c5ebe009f2a0f58b9c24dbd2d6b4c508f", "https://github.com/shopware/shopware"], "fixes": ["6.7.2.1"], "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}]}], "total": 65, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "shopware/core", "path": "vulns/packagist/shopware%2Fcore", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["6.7.8.1", "6.7.6.1", "6.7.4.1", "6.7.3.1", "6.7.2.1", "6.7.0.0-rc2", "6.7.0.0-rc1", "6.6.5.1", "6.6.1.0", "6.5.8.18", "6.5.8.17", "6.5.8.13"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T03:50:30.406257620Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}