Shopware Core vulnerabilities

CVE-2025-27892 [HIGH] CWE-89 Shopware Vulnerable to Blind SQL-injection in DAL aggregations Shopware Vulnerable to Blind SQL-injection in DAL aggregations ### Impact The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” **in nested** object is vulnerabl

CVE-2023-2017 [HIGH] CWE-1336 Shopware Has Improper Control of Generation of Code in Twig rendered views Shopware Has Improper Control of Generation of Code in Twig rendered views ### Impact We fixed with [CVE-2023-22731](https://github.com/shopware/platform/security/advisories/GHSA-93cw-f5jj-x85w) Twig filters to only be executed with allowed functions. It is possible to pass PHP Closures as string or an array and array crafted PHP Closures was not checked against allow list ### Patches The p

CVE-2026-31889 [HIGH] CWE-290 CVE-2026-31889: Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopwa Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop install

CVE-2021-37708 [HIGH] CWE-77 Command injection in mail agent settings Command injection in mail agent settings ### Impact Command injection in mail agent settings ### Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ### Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a

CVE-2024-42355 [HIGH] CWE-1336 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag ### Impact Shopware has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. It accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. ### Patches U

CVE-2023-22731 [CRITICAL] CWE-94 Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views ### Impact In Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows in the template to call any global PHP function. ### Patches The problem has been fixed with 6.4.18.1 with an override of the spec

CVE-2024-42357 [MEDIUM] CWE-89 Shopware vulnerable to blind SQL-injection in DAL aggregations Shopware vulnerable to blind SQL-injection in DAL aggregations ### Impact The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-inject

CVE-2026-31887 [HIGH] CWE-863 CVE-2026-31887: Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.

CVE-2024-22406 [CRITICAL] CWE-89 Blind SQL injection in shopware Blind SQL injection in shopware ### Impact The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. ### P

CVE-2021-37711 [HIGH] CWE-918 Authenticated server-side request forgery in file upload via URL. Authenticated server-side request forgery in file upload via URL. ### Impact Authenticated server-side request forgery in file upload via URL. ### Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ### Workarounds For older versions of

CVE-2023-22732 [LOW] CWE-613 Shopware has Insufficient Session Expiration in Administration Shopware has Insufficient Session Expiration in Administration ### Impact The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. ### Patches We added an automatic logout into the Administration, so the user will be logged out when they are inactive. ### References https://docs.shopware.com/en/shopware-6-en/

CVE-2022-24872 [HIGH] CWE-732 Improper Access Control in Shopware Improper Access Control in Shopware Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 1.500 community extensions. Permissions set to sales channel context by admin-api are still useable within normal user session. We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the

CVE-2026-23498 [HIGH] CWE-94 Shopware Has Improper Control of Generation of Code in Twig rendered views Shopware Has Improper Control of Generation of Code in Twig rendered views ### Impact We fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override ### Patches Patched in 6

CVE-2026-48009 [MEDIUM] CWE-200 Shopware: Admin Account Takeover via User Recovery Hash Exposure Shopware: Admin Account Takeover via User Recovery Hash Exposure ## Summary A low-privilege admin user with `user_recovery:read` ACL can take over any admin account. The attacker triggers password recovery for the victim (unauthenticated endpoint), reads the recovery hash from the Admin API search endpoint, then uses the hash to reset the victim's password (another unauthenticated endpoint). The re

CVE-2024-42356 [HIGH] CWE-1336 Shopware vulnerable to Server Side Template Injection in Twig using Context functions Shopware vulnerable to Server Side Template Injection in Twig using Context functions ### Impact The `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: ```php $co

CVE-2026-48008 [MEDIUM] CWE-862 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass ## Summary A non-admin API user with `integration:create` ACL privilege can escalate to full administrator by creating an integration with `admin: true` through the Sync API (`POST /api/_action/sync`). The regular integration endpoint (`POST /api/integration`) correctly blocks this, but the Sync API bypasses the cont

CVE-2020-13997 [HIGH] CWE-209 Shopware database password is leaked to an unauthenticated users Shopware database password is leaked to an unauthenticated users In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (`shopware/shopware` on packagist).

CVE-2021-37707 [MEDIUM] CWE-20 Manipulation of product reviews via API Manipulation of product reviews via API ### Impact Manipulation of product reviews via API ### Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ### Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a p

CVE-2022-24748 [MEDIUM] CWE-287 Incorrect Authentication in shopware Incorrect Authentication in shopware ### Impact Modify Customers, create Orders without App Permission ## Patches We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ## Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available

CVE-2023-22730 [MEDIUM] CWE-20 Shopware vulnerable to Improper Input Validation of Clearance sale in cart Shopware vulnerable to Improper Input Validation of Clearance sale in cart ### Impact It is possible to put the same line item multiple one in the cart using API, the Cart Validators checked the line item's individuality and the user was able to skip the clearance sale in cart ### Patches The problem has been fixed with 6.4.18.1 ### Workarounds For older versions of 6.1, 6.2, and 6.3, cor