p PatchFirst

CVE-2026-23498

CVE-2026-23498 · Shopware Improper Control of Generation of Code in Twig rendered views

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

CVSS 7.2 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • shopware

    Versions
    • >= 6.7.0.0, < 6.7.6.1: Affected

    No fix published

  • shopware/shopware Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 6.7.0.0, < 6.7.6.1

    Update to 6.7.6.1

  • shopware/core Packagist

    Versions
    • v6.7.0.0
    • v6.7.0.1
    • v6.7.1.0
    • v6.7.1.1
    • v6.7.1.2
    • v6.7.2.0
    • v6.7.2.1
    • v6.7.2.2
    • v6.7.3.0
    • v6.7.3.1
    • v6.7.4.0
    • v6.7.4.1
    • v6.7.4.2
    • v6.7.5.0
    • v6.7.5.1
    • v6.7.6.0
    Affected ranges
    • ECOSYSTEM: ≥ 6.7.0.0, < 6.7.6.1

    Update to 6.7.6.1

Original sources

Check your server →