Shopware Has Improper Control of Generation of Code in Twig rendered views

CAO 7.2CVE-2026-23498 · GHSA-7cw6-7h3h-v8pf · Công bố 14/01/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-23498 là lỗ hổng mức CAO (CVSS 7.2) ảnh hưởng shopware/core, shopware/shopware, shopware (shopware).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.44%, cao hơn 38.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.7.6.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
shopware/core Packagist	`≥ 6.7.0.0, < 6.7.6.1`	`6.7.6.1`
shopware/shopware Packagist	`≥ 6.7.0.0, < 6.7.6.1`	`6.7.6.1`
shopware shopware	`≥ 6.7.0.0, < 6.7.6.1`	`6.7.6.1`

Mô tả

Impact

We fixed with CVE-2023-2017 Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override

Patches

Patched in 6.7.6.1

Workarounds

Install the security plugin

Mô tả của NVD

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.