Shopware Has Improper Control of Generation of Code in Twig rendered views
### Impact We fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override ### Patches Patched in 6.7.6.1 ### Workarounds Install the security plugin
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-23498US | high7.2 | Exploit | ||
Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-7v2v-9rm4-7m8fADVISORY
- https://github.com/shopware/shopwarePACKAGE
- https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475WEB
- https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pfWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-23498ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan