GHSA-7cw6-7h3h-v8pfHighCVSS 7.2

Shopware Has Improper Control of Generation of Code in Twig rendered views

Published
January 14, 2026
Last Modified
January 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-23498 →

📋 Description

Impact

We fixed with CVE-2023-2017 Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override

Patches

Patched in 6.7.6.1

Workarounds

Install the security plugin

🎯 Affected products2

  • composer/shopware/shopware:>= 6.7.0.0, < 6.7.6.1
  • composer/shopware/core:>= 6.7.0.0, < 6.7.6.1

🔗 References (5)