# shopware/core (Packagist) vulnerabilities

45 known vulnerabilities (2 critical, 14 high, 24 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/shopware/core

## Advisories (45)

### [CVE-2026-48012](https://cve.now/CVE-2026-48012): Shopware SSO referer trust leading to an arbitrary redirect target

- Severity: Medium 4.3
- Published: Jul 23, 2026
- Affected: from 6.7.3.0, fixed in 6.7.10.1.

### [CVE-2026-48013](https://cve.now/CVE-2026-48013): Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

- Severity: Medium 4.1
- Published: Jul 23, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1.

### [CVE-2026-48009](https://cve.now/CVE-2026-48009): Shopware: Admin Account Takeover via User Recovery Hash Exposure

- Severity: Medium 6.8
- Published: Jul 17, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

### [CVE-2026-48014](https://cve.now/CVE-2026-48014): Shopware: Admin API ACL Bypass in Order State Transition Endpoints

- Severity: Medium 6.5
- Published: Jul 17, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

### [CVE-2026-48010](https://cve.now/CVE-2026-48010): Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

- Severity: Medium 6.5
- Published: Jul 17, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

### [CVE-2026-48016](https://cve.now/CVE-2026-48016): Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

- Severity: Medium 4.3
- Published: Jul 17, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

### [CVE-2026-48015](https://cve.now/CVE-2026-48015): Shopware: Stored XSS via SVG file upload — no SVG sanitization

- Severity: Medium 4.9
- Published: Jul 17, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

### [CVE-2026-48008](https://cve.now/CVE-2026-48008): Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

- Severity: Medium 6.5
- Published: Jul 17, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

### [CVE-2026-48011](https://cve.now/CVE-2026-48011): Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

- Severity: Low 3.7
- Published: Jun 10, 2026
- Affected: from 6.7.0.0, fixed in 6.7.10.1; fixed in 6.6.10.18.

### [CVE-2026-31889](https://cve.now/CVE-2026-31889): Shopware has a potential take over of app credentials

- Severity: High 8.9
- Published: Mar 11, 2026
- Affected: from 6.7.0.0, fixed in 6.7.8.1; fixed in 6.6.10.15.

### [CVE-2026-31888](https://cve.now/CVE-2026-31888): Shopware has user enumeration via distinct error codes on Store API login endpoint

- Severity: Medium 5.3
- Published: Mar 11, 2026
- Affected: from 6.7.0.0, fixed in 6.7.8.1; fixed in 6.6.10.15.

### [CVE-2026-31887](https://cve.now/CVE-2026-31887): Shopware unauthenticated data extraction possible through store-api.order endpoint

- Severity: High 8.9
- Published: Mar 11, 2026
- Affected: from 6.7.0.0, fixed in 6.7.8.1; fixed in 6.6.10.15.

### [CVE-2026-23498](https://cve.now/CVE-2026-23498): Shopware Improper Control of Generation of Code in Twig rendered views

- Severity: High 7.2
- Published: Jan 14, 2026
- Affected: from 6.7.0.0, fixed in 6.7.6.1.

### [CVE-2025-27892](https://cve.now/CVE-2025-27892): Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.

- Severity: Medium 6.8
- Published: Apr 15, 2025
- Affected: from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; from 6.6.0.0, fixed in 6.6.10.3; fixed in 6.5.8.18.

### [CVE-2025-32378](https://cve.now/CVE-2025-32378): Shopware's default newsletter opt-in settings allow for mass sign-up abuse

- Severity: Medium 6.9
- Published: Apr 9, 2025
- Affected: from 6.6.0.0-rc1, fixed in 6.6.10.3; from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; fixed in 6.5.8.17.

### [CVE-2025-30150](https://cve.now/CVE-2025-30150): Shopware 6 allows attackers to check for registered accounts through the store-api

- Severity: Medium 5.5
- Published: Apr 8, 2025
- Affected: from 6.6.0.0, fixed in 6.6.10.3; from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; fixed in 6.5.8.18.

### [CVE-2025-30151](https://cve.now/CVE-2025-30151): Shopware allows Denial Of Service via password length

- Severity: High 7.5
- Published: Apr 8, 2025
- Affected: from 6.6.0.0, fixed in 6.6.10.3; from 6.7.0.0-rc1, fixed in 6.7.0.0-rc2; fixed in 6.5.8.17.

### [CVE-2024-42357](https://cve.now/CVE-2024-42357): Shopware vulnerable to blind SQL-injection in DAL aggregations

- Severity: High 7.3
- Published: Aug 8, 2024
- Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

### [CVE-2024-42356](https://cve.now/CVE-2024-42356): Shopware vulnerable to Server Side Template Injection in Twig using Context functions

- Severity: High 8.3
- Published: Aug 8, 2024
- Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

### [CVE-2024-42355](https://cve.now/CVE-2024-42355): Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

- Severity: High 8.3
- Published: Aug 8, 2024
- Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

### [CVE-2024-42354](https://cve.now/CVE-2024-42354): Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

- Severity: Medium 5.3
- Published: Aug 8, 2024
- Affected: fixed in 6.5.8.13; from 6.6.0.0, fixed in 6.6.5.1.

### [CVE-2024-31447](https://cve.now/CVE-2024-31447): Shopware has Improper Session Handling in store-api

- Severity: Medium 5.3
- Published: Apr 8, 2024
- Affected: from 6.3.5.0, fixed in 6.5.8.8; from 6.6.0.0-rc1, fixed in 6.6.1.0.

### [CVE-2024-22406](https://cve.now/CVE-2024-22406): Blind SQL-injection in DAL aggregations in Shopware

- Severity: Critical 9.3
- Published: Jan 16, 2024
- Affected: fixed in 6.5.7.4.

### [CVE-2024-22407](https://cve.now/CVE-2024-22407): Broken Access Control order API in Shopware

- Severity: Medium 4.9
- Published: Jan 16, 2024
- Affected: fixed in 6.5.7.4.

### [CVE-2023-2017](https://cve.now/CVE-2023-2017): Improper Control of Generation of Code in Twig Rendered Views in Shopware

- Severity: High 8.8
- Published: Apr 17, 2023
- Affected: fixed in 6.4.20.1.

### [CVE-2023-22733](https://cve.now/CVE-2023-22733): Improper Output Neutralization in Log Module in shopware

- Severity: Low 2.7
- Published: Jan 17, 2023
- Affected: fixed in 6.4.18.1.

### [CVE-2023-22732](https://cve.now/CVE-2023-22732): Insufficient Session Expiration in Administration in shopware

- Severity: Low 3.7
- Published: Jan 17, 2023
- Affected: fixed in 6.4.18.1.

### [CVE-2023-22731](https://cve.now/CVE-2023-22731): Improper Control of Generation of Code in Twig rendered views in shopware

- Severity: Critical 10.0
- Published: Jan 17, 2023
- Affected: fixed in 6.4.18.1.

### [CVE-2023-22730](https://cve.now/CVE-2023-22730): Improper Input Validation of Clearance sale in cart

- Severity: Medium 5.3
- Published: Jan 17, 2023
- Affected: fixed in 6.4.18.1.

### [CVE-2023-22734](https://cve.now/CVE-2023-22734): Improper Input Newsletter subscription option validation in shopware

- Severity: Medium 4.3
- Published: Jan 17, 2023
- Affected: fixed in 6.4.18.1.

### [CVE-2022-24872](https://cve.now/CVE-2022-24872): Improper Access Control in shopware

- Severity: High 8.1
- Published: Apr 20, 2022
- Affected: fixed in 6.4.10.1.

### [CVE-2022-24871](https://cve.now/CVE-2022-24871): Server-Side Request Forgery (SSRF) in Shopware

- Severity: High 7.2
- Published: Apr 20, 2022
- Affected: fixed in 6.4.10.1.

### [CVE-2022-24744](https://cve.now/CVE-2022-24744): Insufficient Session Expiration in shopware

- Severity: Low 2.6
- Published: Mar 9, 2022
- Affected: fixed in 6.4.8.1.

### [CVE-2022-24746](https://cve.now/CVE-2022-24746): HTML injection possibility in voucher code form

- Severity: Medium 6.1
- Published: Mar 9, 2022
- Affected: fixed in 6.4.8.1.

### [CVE-2022-24747](https://cve.now/CVE-2022-24747): HTTP caching is marking private HTTP headers as public

- Severity: Medium 6.3
- Published: Mar 9, 2022
- Affected: fixed in 6.4.8.2.

### [CVE-2022-24748](https://cve.now/CVE-2022-24748): Incorrect Authentication in shopware

- Severity: Medium 6.8
- Published: Mar 9, 2022
- Affected: fixed in 6.4.8.2.

### [CVE-2021-37711](https://cve.now/CVE-2021-37711): Authenticated server-side request forgery in file upload via URL.

- Severity: High 8.8
- Published: Aug 16, 2021
- Affected: fixed in 6.4.3.1.

### [CVE-2021-37710](https://cve.now/CVE-2021-37710): Cross-Site Scripting via SVG media files

- Severity: High 8.0
- Published: Aug 16, 2021
- Affected: fixed in 6.4.3.1.

### [CVE-2021-37709](https://cve.now/CVE-2021-37709): Insecure direct object reference of log files of the Import/Export feature

- Severity: Medium 6.5
- Published: Aug 16, 2021
- Affected: fixed in 6.4.3.1.

### [CVE-2021-37708](https://cve.now/CVE-2021-37708): Command injection in mail agent settings

- Severity: High 8.8
- Published: Aug 16, 2021
- Affected: fixed in 6.4.3.1.

### [CVE-2021-37707](https://cve.now/CVE-2021-37707): Manipulation of product reviews via API

- Severity: Medium 6.5
- Published: Aug 16, 2021
- Affected: fixed in 6.4.3.1.

### [CVE-2021-32717](https://cve.now/CVE-2021-32717): Private files publicly accessible with Cloud Storage providers

- Severity: High 7.5
- Published: Jun 24, 2021
- Affected: fixed in 6.4.1.1.

### [CVE-2021-32716](https://cve.now/CVE-2021-32716): Internal hidden fields are visible on to many associations in admin api

- Severity: Medium 4.4
- Published: Jun 24, 2021
- Affected: fixed in 6.4.1.1.

### [CVE-2021-32709](https://cve.now/CVE-2021-32709): Creation of order credits was not validated by acl in admin orders

- Severity: Medium 4.9
- Published: Jun 24, 2021
- Affected: fixed in 6.4.1.1.

### [CVE-2020-13997](https://cve.now/CVE-2020-13997): In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error…

- Severity: Unrated
- Published: Jul 28, 2020
- Affected: from 6.0.0, fixed in 6.2.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/shopware/core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.