p PatchFirst

PatchFirst · Latest vulnerabilities

shopware/shopware 6.7.2.1: known vulnerabilities

Known vulnerabilities affecting shopware/shopware 6.7.2.1: 2. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-23498

    High · CVSS 7.2EPSS 0.44%Fix available

    Shopware Improper Control of Generation of Code in Twig rendered views

    Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

    shopware/shopwarePHP
    • Update to 6.7.6.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2025-67648

    High · CVSS 7.1EPSS 0.19%Fix available

    Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page

    Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.

    shopware/shopwarePHP
    • Update to 6.7.5.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →