Composer shopware/core has 65 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-27892 | Shopware Vulnerable to Blind SQL-injection in DAL aggregations | high | 7.3 | >=6.7.0.0-rc1 and <6.7.0.0-rc2 or >=6.6.0.0 and <6.6.10.3 or <6.5.8.18 | 6.7.0.0-rc2, 6.6.10.3, 6.5.8.18 |
| CVE-2021-37708 | Command injection in mail agent settings | high | 8.8 | <6.4.3.1 | 6.4.3.1 |
| CVE-2023-2017 | Shopware Has Improper Control of Generation of Code in Twig rendered views | high | 8.8 | <6.4.20.1 | 6.4.20.1 |
| CVE-2020-13997 | Shopware database password is leaked to an unauthenticated users | high | 7.5 | >=6.0.0 and <6.2.3 | 6.2.3 |
| CVE-2021-32717 | Private files publicly accessible with Cloud Storage providers | high | 7.5 | <6.4.1.1 | 6.4.1.1 |
| CVE-2023-22731 | Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views | critical | 9.8 | <6.4.18.1 | 6.4.18.1 |
| CVE-2021-32716 | Internal hidden fields are visible on to many associations in admin api | medium | 0.0 | <6.4.1.1 | 6.4.1.1 |
| CVE-2022-24747 | HTTP caching is marking private HTTP headers as public in Shopware | medium | 6.3 | <6.4.8.2 | 6.4.8.2 |
| CVE-2022-24871 | Server-Side Request Forgery (SSRF) in Shopware | high | 7.2 | <6.4.10.1 | 6.4.10.1 |
| CVE-2021-37711 | Authenticated server-side request forgery in file upload via URL. | high | 8.8 | <6.4.3.1 | 6.4.3.1 |
| CVE-2022-24872 | Improper Access Control in Shopware | high | 8.1 | <6.4.10.1 | 6.4.10.1 |
| CVE-2021-37707 | Manipulation of product reviews via API | medium | 6.5 | <6.4.3.1 | 6.4.3.1 |
| CVE-2024-42355 | Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag | high | 8.3 | <6.5.8.13 or >=6.6.0.0 and <6.6.5.1 | 6.5.8.13, 6.6.5.1 |
| CVE-2022-24746 | HTML injection possibility in voucher code form in Shopware | medium | 6.1 | <6.4.8.1 | 6.4.8.1 |
| CVE-2021-37709 | Insecure direct object reference of log files of the Import/Export feature | medium | 6.5 | <6.4.3.1 | 6.4.3.1 |
| CVE-2023-22732 | Shopware has Insufficient Session Expiration in Administration | low | 3.7 | <6.4.18.1 | 6.4.18.1 |
| CVE-2022-24748 | Incorrect Authentication in shopware | medium | 6.8 | <6.4.8.2 | 6.4.8.2 |
| CVE-2023-22733 | Shopware's log module vulnerable to Improper Output Neutralization | low | 2.7 | <6.4.18.1 | 6.4.18.1 |
| CVE-2021-37710 | Cross-Site Scripting via SVG media files | high | 8.0 | <6.4.3.1 | 6.4.3.1 |
| CVE-2023-22730 | Shopware vulnerable to Improper Input Validation of Clearance sale in cart | medium | 6.3 | <6.4.18.1 | 6.4.18.1 |
| CVE-2024-42356 | Shopware vulnerable to Server Side Template Injection in Twig using Context functions | high | 8.3 | <6.5.8.13 or >=6.6.0.0 and <6.6.5.1 | 6.5.8.13, 6.6.5.1 |
| CVE-2024-22406 | Blind SQL injection in shopware | critical | 9.3 | <6.5.7.4 | 6.5.7.4 |
| CVE-2023-22734 | Shopware has Improper Input Validation issue in newsletter subscription | medium | 4.3 | <6.4.18.1 | 6.4.18.1 |
| CVE-2021-32709 | Creation of order credits was not validated by acl in admin orders | low | 0.0 | <6.4.1.1 | 6.4.1.1 |
| CVE-2024-42357 | Shopware vulnerable to blind SQL-injection in DAL aggregations | high | 7.3 | <6.5.8.13 or >=6.6.0.0 and <6.6.5.1 | 6.5.8.13, 6.6.5.1 |
| CVE-2024-31447 | Shopware Improper Session Handling in store-api account logout | medium | 5.3 | >=6.3.5.0 and <6.5.8.8 or >=6.6.0.0-rc1 and <6.6.1.0 | 6.5.8.8, 6.6.1.0 |
| CVE-2026-48015 | Shopware: Stored XSS via SVG file upload — no SVG sanitization | medium | 4.9 | >=6.7.0.0 and <6.7.10.1 or <6.6.10.18 | 6.7.10.1, 6.6.10.18 |
| CVE-2022-24744 | Shopware user session is not logged out if the password is reset via password recovery | low | 2.6 | <6.4.8.1 | 6.4.8.1 |
| CVE-2026-48008 | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass | medium | 6.5 | >=6.7.0.0 and <6.7.10.1 or <6.6.10.18 | 6.7.10.1, 6.6.10.18 |
| CVE-2026-48010 | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts | medium | 6.5 | >=6.7.0.0 and <6.7.10.1 or <6.6.10.18 | 6.7.10.1, 6.6.10.18 |
| CVE-2026-48009 | Shopware: Admin Account Takeover via User Recovery Hash Exposure | medium | 6.8 | >=6.7.0.0 and <6.7.10.1 or <6.6.10.18 | 6.7.10.1, 6.6.10.18 |
| CVE-2026-23498 | Shopware Has Improper Control of Generation of Code in Twig rendered views | high | 7.2 | >=6.7.0.0 and <6.7.6.1 | 6.7.6.1 |
| CVE-2024-42354 | Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api | medium | 5.3 | <6.5.8.13 or >=6.6.0.0 and <6.6.5.1 | 6.5.8.13, 6.6.5.1 |
| CVE-2025-30151 | Shopware allows Denial Of Service via password length | high | 7.5 | >=6.6.0.0 and <6.6.10.3 or >=6.7.0.0-rc1 and <6.7.0.0-rc2 or <6.5.8.17 | 6.6.10.3, 6.7.0.0-rc2, 6.5.8.17 |
| CVE-2026-48016 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | medium | 4.3 | >=6.7.0.0 and <6.7.10.1 or <6.6.10.18 | 6.7.10.1, 6.6.10.18 |
| CVE-2024-22407 | Broken Access Control order API in Shopware | medium | 4.9 | <6.5.7.4 | 6.5.7.4 |
| CVE-2025-30150 | Shopware 6 allows attackers to check for registered accounts through the store-api | medium | 5.3 | >=6.6.0.0 and <6.6.10.3 or >=6.7.0.0-rc1 and <6.7.0.0-rc2 or <6.5.8.18 | 6.6.10.3, 6.7.0.0-rc2, 6.5.8.18 |
| CVE-2026-48014 | Shopware: Admin API ACL Bypass in Order State Transition Endpoints | medium | 6.5 | >=6.7.0.0 and <6.7.10.1 or <6.6.10.18 | 6.7.10.1, 6.6.10.18 |
| CVE-2026-48013 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | medium | 4.1 | >=6.7.0.0 and <6.7.10.1 | 6.7.10.1 |
| CVE-2025-32378 | Shopware default newsletter opt-in settings allow for mass sign-up abuse | medium | 5.3 | >=6.6.0.0-rc1 and <6.6.10.3 or >=6.7.0.0-rc1 and <6.7.0.0-rc2 or <6.5.8.17 | 6.6.10.3, 6.7.0.0-rc2, 6.5.8.17 |
| CVE-2026-31889 | Shopware vulnerable to a potential take over of app credentials | high | 8.9 | >=6.7.0.0 and <6.7.8.1 or <6.6.10.15 | 6.7.8.1, 6.6.10.15 |
| CVE-2026-48012 | Shopware SSO referer trust leading to an arbitrary redirect target | medium | 4.3 | >=6.7.3.0 and <6.7.10.1 | 6.7.10.1 |
| CVE-2026-31887 | Shopware: Unauthenticated data extraction possible through store-api.order endpoint | high | 0.0 | >=6.7.0.0 and <6.7.8.1 or <6.6.10.15 | 6.7.8.1, 6.6.10.15 |
| CVE-2026-31888 | Shopware has user enumeration via distinct error codes on Store API login endpoint | medium | 5.3 | >=6.7.0.0 and <6.7.8.1 or <6.6.10.15 | 6.7.8.1, 6.6.10.15 |
| CVE-2026-48011 | Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | low | 3.7 | >=6.7.0.0 and <6.7.10.1 or <6.6.10.18 | 6.7.10.1, 6.6.10.18 |
| GHSA-9v82-vcjx-m76j | Shopware: Reflective Cross Site-Scripting (XSS) in CMS components | high | 8.8 | >=6.7.0.0 and <6.7.2.1 | 6.7.2.1 |
| GHSA-8xv9-qcr9-ww9j | Authenticated XML External Entity Processing | medium | 5.6 | <6.3.2.1 | 6.3.2.1 |
| GHSA-m895-2hj3-8cg9 | Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually | medium | 5.3 | >=6.7.0.0 and <6.7.3.1 or <6.6.10.7 | 6.7.3.1, 6.6.10.7 |
| GHSA-2w46-vq8h-98vh | Shopware 6's password recovery link does not expire after email change | medium | 5.0 | <6.6.10.9 or >=6.7.0.0 and <6.7.4.1 | 6.6.10.9, 6.7.4.1 |
| GHSA-27c9-vp3w-6ww8 | Shopware exposes sensitive user information via CSV export mapping | medium | 4.9 | >=6.7.0.0 and <6.7.3.1 or <6.6.10.7 | 6.7.3.1, 6.6.10.7 |
| GHSA-r2vg-hvjm-fg38 | Shopware Customer Orders can be canceled, even if refunds are disabled | medium | 4.3 | >=6.7.0.0 and <6.7.3.1 or <6.6.10.7 | 6.7.3.1, 6.6.10.7 |
| GHSA-68wv-g3fw-pq7q | Shopware Broken ACL on Document retrieval to access other customers documents | medium | 4.0 | >=6.6.0.0 and <6.6.10.3 or >=6.7.0.0-rc1 and <6.7.0.0-rc2 or <6.5.8.17 | 6.6.10.3, 6.7.0.0-rc2, 6.5.8.17 |
| GHSA-3cpp-fv95-mpr5 | Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice | low | 2.7 | >=6.7.0.0 and <6.7.3.1 or <6.6.10.7 | 6.7.3.1, 6.6.10.7 |
| GHSA-6wh5-mw9h-5c3w | Shopware vulnerable to path traversal via Plugin upload | low | 2.7 | >=6.7.0.0 and <6.7.3.1 or <6.6.10.7 | 6.7.3.1, 6.6.10.7 |
| GHSA-243q-g9j3-qf6r | non-admin users can create integration role with administrator role | medium | 0.0 | <6.4.1.1 | 6.4.1.1 |
| GHSA-5q58-x5h2-v5rx | Authenticated Privilege Escalation | low | 0.0 | <6.3.4.1 | 6.3.4.1 |
| GHSA-88rc-3p98-rgvx | After order payment process manipulation in shopware/platform and shopware/core | critical | 0.0 | <6.3.5.3 | 6.3.5.3 |
| GHSA-8pfh-mm2g-hmc3 | Authenticated Server Side Request Forgery | low | 0.0 | <6.3.4.1 | 6.3.4.1 |
| GHSA-cq6h-w3mc-57f4 | Information exposure via query strings in URL | low | 0.0 | <6.3.4.1 | 6.3.4.1 |
| GHSA-p68v-frgx-4rjp | Denial of Service via Cache Flooding | low | 0.0 | <6.3.2.1 | 6.3.2.1 |
| GHSA-qg7c-q3vq-rgxr | Leak of information via Store-API aggregations in shopware/platform and shopware/core | critical | 0.0 | <6.3.5.3 | 6.3.5.3 |
| GHSA-qvc5-cfrr-384v | RCE in Third Party Library in Shopware | low | 0.0 | <6.3.1.1 | 6.3.1.1 |
| GHSA-qvhr-55hg-3qwv | Non-persistent XSS in the Storefront in Shopware | low | 0.0 | <6.3.1.1 | 6.3.1.1 |
| GHSA-r64m-qchj-hrjp | Webcache Poisoning in shopware/platform and shopware/core | critical | 0.0 | <6.4.6.1 | 6.4.6.1 |
| GHSA-wq3r-jwrq-xg6w | Canceling of orders not related to the logged-in user | medium | 0.0 | <6.4.1.1 | 6.4.1.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked