Shopware Platform vulnerabilities

CVE-2025-7954 [MEDIUM] CWE-362 Shopware race condition bypasses voucher restrictions Shopware race condition bypasses voucher restrictions A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

CVE-2023-22734 [HIGH] CWE-20 CVE-2023-22734: Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter d Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are adv

CVE-2026-48010 [MEDIUM] CWE-269 CVE-2026-48010: Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; Integ

CVE-2024-42356 [HIGH] CWE-1336 Shopware vulnerable to Server Side Template Injection in Twig using Context functions Shopware vulnerable to Server Side Template Injection in Twig using Context functions ### Impact The `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: ```php $co

CVE-2021-32710 [HIGH] CWE-384 CVE-2021-32710: Shopware is an open source eCommerce platform. Potential session hijacking of store customers in ver Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are al

CVE-2020-13997 [HIGH] CWE-209 Shopware database password is leaked to an unauthenticated users Shopware database password is leaked to an unauthenticated users In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (`shopware/shopware` on packagist).

CVE-2024-27917 [HIGH] CWE-524 Shopware's session is persistent in Cache for 404 pages Shopware's session is persistent in Cache for 404 pages ### Impact The Symfony Session Handler, pop's the Session Cookie and assign it to the Response. Since Shopware 6.5.8.0 the 404 pages, are cached, to improve the performance of 404 pages. So the cached Response, contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Se

CVE-2023-22733 [MEDIUM] CWE-532 CVE-2023-22733: Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected vers Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older ve

CVE-2026-48014 [MEDIUM] CWE-862 CVE-2026-48014: Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition f Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or perform an explicit privilege chec

CVE-2025-30151 [HIGH] CWE-20 Shopware allows Denial Of Service via password length Shopware allows Denial Of Service via password length ### Impact It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. ### Patches Update to Shopware 6.6.10.3 or 6.5.8.17 ### Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopwa

CVE-2021-37709 [MEDIUM] CWE-532 CVE-2021-37709: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability inv Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

CVE-2022-24745 [MEDIUM] CWE-384 CVE-2022-24745: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript fram Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version

CVE-2024-22407 [MEDIUM] CWE-284 Broken Access Control order API in Shopware Broken Access Control order API in Shopware ### Impact In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. ### Patches Update to Shopware 6.5.7.4 ### Workarounds For older version

CVE-2024-42354 [MEDIUM] CWE-284 Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api ### Impact The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. The processing of the Criteria did not cons

CVE-2022-24871 [MEDIUM] CWE-918 CVE-2022-24871: Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an at Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available v

CVE-2026-31888 [MEDIUM] CWE-204 CVE-2026-31888: Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error codes depending on whether the submitted email address belongs to a registered customer (CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS) or is unknown (CHECKOUT__CUSTOMER_NOT_FOUND). The "not found" resp

CVE-2026-48015 [MEDIUM] CWE-79 CVE-2026-48015: Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing mali

CVE-2025-30150 [MEDIUM] CWE-204 Shopware 6 allows attackers to check for registered accounts through the store-api Shopware 6 allows attackers to check for registered accounts through the store-api ### Impact Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint `/store-api/account/recovery-password` you get the response ``` {"errors":[{"status":"404","code":"CHECKOUT__CUSTOMER_NOT_FOUND","title":"Not F

CVE-2022-24746 [MEDIUM] CWE-79 CVE-2022-24746: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript fram Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.

CVE-2022-24747 [MEDIUM] CWE-200 CVE-2022-24747: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript fram Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. T