Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

shopware/core

45 known vulnerabilities (2 critical, 14 high, 24 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
45 · 2 critical, 14 high, 24 medium, 4 low
Registry
Packagist

Advisories 45

  • CVE-2026-48012Medium 4.3

    Shopware SSO referer trust leading to an arbitrary redirect target

    Affected: from 6.7.3.0, fixed in 6.7.10.1.

  • CVE-2026-48013Medium 4.1

    Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

    Affected: from 6.7.0.0, fixed in 6.7.10.1.

  • CVE-2026-48009Medium 6.8

    Shopware: Admin Account Takeover via User Recovery Hash Exposure

    Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

  • CVE-2026-48014Medium 6.5

    Shopware: Admin API ACL Bypass in Order State Transition Endpoints

    Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

  • CVE-2026-48010Medium 6.5

    Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

    Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

  • CVE-2026-48016Medium 4.3

    Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

    Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

  • CVE-2026-48015Medium 4.9

    Shopware: Stored XSS via SVG file upload — no SVG sanitization

    Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

  • CVE-2026-48008Medium 6.5

    Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

    Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

  • Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

    Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

  • Shopware has a potential take over of app credentials

    Affected: from 6.7.0.0, fixed in 6.7.8.1; fixed in 6.6.10.15.

  • CVE-2026-31888Medium 5.3

    Shopware has user enumeration via distinct error codes on Store API login endpoint

    Affected: from 6.7.0.0, fixed in 6.7.8.1; fixed in 6.6.10.15.

  • Shopware unauthenticated data extraction possible through store-api.order endpoint

    Affected: from 6.7.0.0, fixed in 6.7.8.1; fixed in 6.6.10.15.

  • Shopware Improper Control of Generation of Code in Twig rendered views

    Affected: from 6.7.0.0, fixed in 6.7.6.1.

  • CVE-2025-27892Medium 6.8

    Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.

    Affected: from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; from 6.6.0.0, fixed in 6.6.10.3; fixed in 6.5.8.18.

  • CVE-2025-32378Medium 6.9

    Shopware's default newsletter opt-in settings allow for mass sign-up abuse

    Affected: from 6.6.0.0-rc1, fixed in 6.6.10.3; from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; fixed in 6.5.8.17.

Show all 45 advisoriesShow fewer advisories
  • CVE-2025-30150Medium 5.5

    Shopware 6 allows attackers to check for registered accounts through the store-api

    Affected: from 6.6.0.0, fixed in 6.6.10.3; from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; fixed in 6.5.8.18.

  • Shopware allows Denial Of Service via password length

    Affected: from 6.6.0.0, fixed in 6.6.10.3; from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; fixed in 6.5.8.17.

  • Shopware vulnerable to blind SQL-injection in DAL aggregations

    Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

  • Shopware vulnerable to Server Side Template Injection in Twig using Context functions

    Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

  • Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

    Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

  • CVE-2024-42354Medium 5.3

    Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

    Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

  • CVE-2024-31447Medium 5.3

    Shopware has Improper Session Handling in store-api

    Affected: from 6.3.5.0, fixed in 6.5.8.8; from 6.6.0.0-rc1, fixed in 6.6.1.0.

  • CVE-2024-22406Critical 9.3

    Blind SQL-injection in DAL aggregations in Shopware

    Affected: fixed in 6.5.7.4.

  • CVE-2024-22407Medium 4.9

    Broken Access Control order API in Shopware

    Affected: fixed in 6.5.7.4.

  • Improper Control of Generation of Code in Twig Rendered Views in Shopware

    Affected: fixed in 6.4.20.1.

  • Improper Output Neutralization in Log Module in shopware

    Affected: fixed in 6.4.18.1.

  • Insufficient Session Expiration in Administration in shopware

    Affected: fixed in 6.4.18.1.

  • CVE-2023-22731Critical 10.0

    Improper Control of Generation of Code in Twig rendered views in shopware

    Affected: fixed in 6.4.18.1.

  • CVE-2023-22730Medium 5.3

    Improper Input Validation of Clearance sale in cart

    Affected: fixed in 6.4.18.1.

  • CVE-2023-22734Medium 4.3

    Improper Input Newsletter subscription option validation in shopware

    Affected: fixed in 6.4.18.1.

  • Improper Access Control in shopware

    Affected: fixed in 6.4.10.1.

  • Server-Side Request Forgery (SSRF) in Shopware

    Affected: fixed in 6.4.10.1.

  • Insufficient Session Expiration in shopware

    Affected: fixed in 6.4.8.1.

  • CVE-2022-24746Medium 6.1

    HTML injection possibility in voucher code form

    Affected: fixed in 6.4.8.1.

  • CVE-2022-24747Medium 6.3

    HTTP caching is marking private HTTP headers as public

    Affected: fixed in 6.4.8.2.

  • CVE-2022-24748Medium 6.8

    Incorrect Authentication in shopware

    Affected: fixed in 6.4.8.2.

  • Authenticated server-side request forgery in file upload via URL.

    Affected: fixed in 6.4.3.1.

  • Cross-Site Scripting via SVG media files

    Affected: fixed in 6.4.3.1.

  • CVE-2021-37709Medium 6.5

    Insecure direct object reference of log files of the Import/Export feature

    Affected: fixed in 6.4.3.1.

  • Command injection in mail agent settings

    Affected: fixed in 6.4.3.1.

  • CVE-2021-37707Medium 6.5

    Manipulation of product reviews via API

    Affected: fixed in 6.4.3.1.

  • Private files publicly accessible with Cloud Storage providers

    Affected: fixed in 6.4.1.1.

  • CVE-2021-32716Medium 4.4

    Internal hidden fields are visible on to many associations in admin api

    Affected: fixed in 6.4.1.1.

  • CVE-2021-32709Medium 4.9

    Creation of order credits was not validated by acl in admin orders

    Affected: fixed in 6.4.1.1.

  • In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error…

    Affected: from 6.0.0, fixed in 6.2.3.