Shopware Has Improper Control of Generation of Code in Twig rendered views
### Impact We fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override ### Patches Patched in 6.7.6.1 ### Workarounds Install the security plugin
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-23498US | high7.2 | Exploit | ||
Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-7v2v-9rm4-7m8fADVISORY
- https://github.com/shopware/shopwarePACKAGE
- https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475WEB
- https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pfWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-23498ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan