GitHub Advisoryadvisory · Packagist

GHSA-7cw6-7h3h-v8pf Shopware Has Improper Control of Generation of Code in Twig rendered views

HIGH Published 2026-01-14 Modified 2026-01-14 Official page ↗
Aliases
CVE-2026-23498
Ecosystem
Packagist
Packages
shopware/shopware, shopware/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2026-01-14

Affected packages

• Packagist shopware/shopware: >= 6.7.0.0, < 6.7.6.1 → fixed in 6.7.6.1 • Packagist shopware/core: >= 6.7.0.0, < 6.7.6.1 → fixed in 6.7.6.1

Description

Impact We fixed with CVE-2023-2017 Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override Patches Patched in 6.7.6.1 Workarounds Install the security plugin

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References