PHP package security
Is shopware/core vulnerable?
65 known security advisories for shopware/core. The latest was reported on 2026-06-04 and is fixed in 6.7.10.1. The newest release, 6.7.16.0, is not affected by any of them.
5 critical 16 high 30 medium 14 low
- Known advisories
- 65
- Newest release
- 6.7.16.0
- Released
- 2026-10-22
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for shopware/core
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-06-04 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation GHSA-gq96-5pfx-f4vc · CVE-2026-48013 · GitHub | medium | >=6.7.0.0,<6.7.10.1 | 6.7.10.1 |
| 2026-06-04 | Shopware: Stored XSS via SVG file upload — no SVG sanitization GHSA-xvhc-gm7j-mhmc · CVE-2026-48015 · GitHub | medium | <6.6.10.18 | >=6.7.0.0,<6.7.10.1 | 6.6.10.18, 6.7.10.1 |
| 2026-06-04 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment GHSA-9v5m-39wh-5chq · CVE-2026-48016 · GitHub | medium | <6.6.10.18 | >=6.7.0.0,<6.7.10.1 | 6.6.10.18, 6.7.10.1 |
| 2026-06-04 | Shopware: Admin API ACL Bypass in Order State Transition Endpoints GHSA-f8q6-3g5w-jjr6 · CVE-2026-48014 · GitHub | medium | <6.6.10.18 | >=6.7.0.0,<6.7.10.1 | 6.6.10.18, 6.7.10.1 |
| 2026-06-04 | Shopware SSO referer trust leading to an arbitrary redirect target GHSA-4x3x-869w-xx3m · CVE-2026-48012 · GitHub | medium | >=6.7.3.0,<6.7.10.1 | 6.7.10.1 |
| 2026-06-04 | Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames GHSA-7w52-7jvm-m9vw · CVE-2026-48011 · GitHub | low | <6.6.10.18 | >=6.7.0.0,<6.7.10.1 | 6.6.10.18, 6.7.10.1 |
| 2026-06-04 | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts GHSA-v39m-97p8-gqg7 · CVE-2026-48010 · GitHub | medium | <6.6.10.18 | >=6.7.0.0,<6.7.10.1 | 6.6.10.18, 6.7.10.1 |
| 2026-06-04 | Shopware: Admin Account Takeover via User Recovery Hash Exposure GHSA-8v9p-g828-v98f · CVE-2026-48009 · GitHub | medium | <6.6.10.18 | >=6.7.0.0,<6.7.10.1 | 6.6.10.18, 6.7.10.1 |
| 2026-06-04 | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass GHSA-gv8p-48fr-4fxg · CVE-2026-48008 · GitHub | medium | <6.6.10.18 | >=6.7.0.0,<6.7.10.1 | 6.6.10.18, 6.7.10.1 |
| 2026-03-11 | Shopware vulnerable to a potential take over of app credentials GHSA-c4p7-rwrg-pf6p · CVE-2026-31889 · GitHub | high | <6.6.10.15 | >=6.7.0.0,<6.7.8.1 | 6.6.10.15, 6.7.8.1 |
| 2026-03-11 | Shopware has user enumeration via distinct error codes on Store API login endpoint GHSA-gqc5-xv7m-gcjq · CVE-2026-31888 · GitHub | medium | <6.6.10.15 | >=6.7.0.0,<6.7.8.1 | 6.6.10.15, 6.7.8.1 |
| 2026-03-11 | Shopware: Unauthenticated data extraction possible through store-api.order endpoint GHSA-7vvp-j573-5584 · CVE-2026-31887 · GitHub | high | <6.6.10.15 | >=6.7.0.0,<6.7.8.1 | 6.6.10.15, 6.7.8.1 |
| 2026-01-14 | Shopware Has Improper Control of Generation of Code in Twig rendered views GHSA-7cw6-7h3h-v8pf · CVE-2026-23498 · GitHub | high | >=6.7.0.0,<6.7.6.1 | 6.7.6.1 |
| 2025-11-14 | Shopware 6's password recovery link does not expire after email change GHSA-2w46-vq8h-98vh · GitHub | medium | >=6.7.0.0,<6.7.4.1 | <6.6.10.9 | 6.6.10.9, 6.7.4.1 |
| 2025-10-21 | Shopware Customer Orders can be canceled, even if refunds are disabled GHSA-r2vg-hvjm-fg38 · GitHub | medium | <6.6.10.7 | >=6.7.0.0,<6.7.3.1 | 6.6.10.7, 6.7.3.1 |
| 2025-10-21 | Shopware exposes sensitive user information via CSV export mapping GHSA-27c9-vp3w-6ww8 · GitHub | medium | <6.6.10.7 | >=6.7.0.0,<6.7.3.1 | 6.6.10.7, 6.7.3.1 |
| 2025-10-21 | Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice GHSA-3cpp-fv95-mpr5 · GitHub | low | <6.6.10.7 | >=6.7.0.0,<6.7.3.1 | 6.6.10.7, 6.7.3.1 |
| 2025-10-21 | Shopware vulnerable to path traversal via Plugin upload GHSA-6wh5-mw9h-5c3w · GitHub | low | <6.6.10.7 | >=6.7.0.0,<6.7.3.1 | 6.6.10.7, 6.7.3.1 |
| 2025-10-21 | Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually GHSA-m895-2hj3-8cg9 · GitHub | medium | <6.6.10.7 | >=6.7.0.0,<6.7.3.1 | 6.6.10.7, 6.7.3.1 |
| 2025-09-10 | Shopware: Reflective Cross Site-Scripting (XSS) in CMS components GHSA-9v82-vcjx-m76j · GitHub | high | >=6.7.0.0,<6.7.2.1 | 6.7.2.1 |
| 2025-04-09 | Shopware default newsletter opt-in settings allow for mass sign-up abuse GHSA-4h9w-7vfp-px8m · CVE-2025-32378 · GitHub | low | <6.5.8.17 | >=6.7.0.0-rc1,<6.7.0.0-rc2 | >=6.6.0.0-rc1,<6.6.10.3 | 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2 |
| 2025-04-08 | Shopware Broken ACL on Document retrieval to access other customers documents GHSA-68wv-g3fw-pq7q · GitHub | medium | <6.5.8.17 | >=6.7.0.0-rc1,<6.7.0.0-rc2 | >=6.6.0.0,<6.6.10.3 | 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2 |
| 2025-04-08 | Shopware Vulnerable to Blind SQL-injection in DAL aggregations GHSA-8g35-7rmw-7f59 · CVE-2025-27892 · GitHub | high | <6.5.8.18 | >=6.6.0.0,<=6.6.10.2 | =6.7.0.0-rc1 | 6.5.8.18 |
| 2025-04-08 | Shopware allows Denial Of Service via password length GHSA-cgfj-hj93-rmh2 · CVE-2025-30151 · GitHub | high | <6.5.8.17 | >=6.7.0.0-rc1,<6.7.0.0-rc2 | >=6.6.0.0,<6.6.10.3 | 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2 |
| 2025-04-08 | Shopware 6 allows attackers to check for registered accounts through the store-api GHSA-hh7j-6x3q-f52h · CVE-2025-30150 · GitHub | medium | <=6.5.8.17 | >=6.6.0.0,<=6.6.10.2 | =6.7.0.0-rc1 | not stated |
| 2024-08-08 | Shopware vulnerable to blind SQL-injection in DAL aggregations GHSA-p6w9-r443-r752 · CVE-2024-42357 · GitHub | medium | >=6.6.0.0,<=6.6.5.0 | <=6.5.8.12 | not stated |
| 2024-08-08 | Shopware vulnerable to Server Side Template Injection in Twig using Context functions GHSA-35jp-8cgg-p4wj · CVE-2024-42356 · GitHub | high | >=6.6.0.0,<=6.6.5.0 | <=6.5.8.12 | not stated |
| 2024-08-08 | Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag GHSA-27wp-jvhw-v4xp · CVE-2024-42355 · GitHub | high | >=6.6.0.0,<=6.6.5.0 | <=6.5.8.12 | not stated |
| 2024-08-08 | Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api GHSA-hhcq-ph6w-494g · CVE-2024-42354 · GitHub | medium | >=6.6.0.0,<=6.6.5.0 | <=6.5.8.12 | not stated |
| 2024-04-08 | Shopware Improper Session Handling in store-api account logout GHSA-5297-wrrp-rcj7 · CVE-2024-31447 · GitHub | medium | >=6.6.0.0-rc1,<6.6.1.0 | >=6.3.5.0,<6.5.8.8 | 6.5.8.8, 6.6.1.0 |
| 2024-01-17 | Broken Access Control order API in Shopware GHSA-3867-jc5c-66qf · CVE-2024-22407 · GitHub | medium | <=6.5.7.3 | not stated |
| 2024-01-17 | Blind SQL injection in shopware GHSA-qmp9-2xwj-m6m9 · CVE-2024-22406 · GitHub | critical | <=6.5.7.3 | not stated |
| 2023-04-18 | Shopware Has Improper Control of Generation of Code in Twig rendered views GHSA-7v2v-9rm4-7m8f · CVE-2023-2017 · GitHub | high | <=6.4.20.0 | not stated |
| 2023-01-20 | Shopware has Improper Input Validation issue in newsletter subscription GHSA-46h7-vj7x-fxg2 · CVE-2023-22734 · GitHub | medium | <=6.4.18.0 | not stated |
| 2023-01-20 | Shopware has Insufficient Session Expiration in Administration GHSA-59qg-93jg-236f · CVE-2023-22732 · GitHub | low | <=6.4.18.0 | not stated |
| 2023-01-20 | Shopware's log module vulnerable to Improper Output Neutralization GHSA-7cp7-jfp6-jh4f · CVE-2023-22733 · GitHub | low | <=6.4.18.0 | not stated |
| 2023-01-17 | Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views GHSA-93cw-f5jj-x85w · CVE-2023-22731 · GitHub | critical | <=6.4.18.0 | not stated |
| 2023-01-17 | Shopware vulnerable to Improper Input Validation of Clearance sale in cart GHSA-8r6h-m72v-38fg · CVE-2023-22730 · GitHub | medium | <=6.4.18.0 | not stated |
| 2022-05-24 | Shopware database password is leaked to an unauthenticated users GHSA-r4ph-mx67-x58p · CVE-2020-13997 · GitHub | high | >=6.0.0,<6.2.3 | 6.2.3 |
| 2022-04-22 | Improper Access Control in Shopware GHSA-9wrv-g75h-8ccc · CVE-2022-24872 · GitHub | high | <=6.3.4.0 | not stated |
| 2022-04-22 | Server-Side Request Forgery (SSRF) in Shopware GHSA-7gm7-8q8v-9gf2 · CVE-2022-24871 · GitHub | high | <=6.4.9.0 | not stated |
| 2022-03-10 | Incorrect Authentication in shopware GHSA-83vp-6jqg-6cmr · CVE-2022-24748 · GitHub | medium | <=6.4.8.1 | not stated |
| 2022-03-10 | HTTP caching is marking private HTTP headers as public in Shopware GHSA-6wrh-279j-6hvw · CVE-2022-24747 · GitHub | medium | <=6.4.8.1 | not stated |
| 2022-03-10 | HTML injection possibility in voucher code form in Shopware GHSA-952p-fqcp-g8pc · CVE-2022-24746 · GitHub | medium | <=6.4.8.0 | not stated |
| 2022-03-10 | Shopware user session is not logged out if the password is reset via password recovery GHSA-w267-m9c4-8555 · CVE-2022-24744 · GitHub | low | <=6.4.8.0 | not stated |
| 2021-11-24 | Webcache Poisoning in shopware/platform and shopware/core GHSA-r64m-qchj-hrjp · GitHub | critical | <=6.4.6.0 | not stated |
| 2021-08-30 | Insecure direct object reference of log files of the Import/Export feature GHSA-54gp-qff8-946c · CVE-2021-37709 · GitHub | medium | <=6.4.3.0 | not stated |
| 2021-08-30 | Command injection in mail agent settings GHSA-xh55-2fqp-p775 · CVE-2021-37708 · GitHub | high | <=6.4.3.0 | not stated |
| 2021-08-30 | Manipulation of product reviews via API GHSA-9f8f-574q-8jmf · CVE-2021-37707 · GitHub | medium | <=6.4.3.0 | not stated |
| 2021-08-23 | Cross-Site Scripting via SVG media files GHSA-fc38-mxwr-pfhx · CVE-2021-37710 · GitHub | high | <=6.4.3.0 | not stated |
| 2021-08-23 | Authenticated server-side request forgery in file upload via URL. GHSA-gcvv-gq92-x94r · CVE-2021-37711 · GitHub | high | <=6.4.3.0 | not stated |
| 2021-06-28 | non-admin users can create integration role with administrator role GHSA-243q-g9j3-qf6r · GitHub | medium | <=6.4.1.0 | not stated |
| 2021-06-28 | Internal hidden fields are visible on to many associations in admin api GHSA-gpmh-g94g-qrhr · GitHub | medium | <=6.4.1.0 | not stated |
| 2021-06-28 | Private files publicly accessible with Cloud Storage providers GHSA-vrf2-xghr-j52v · GitHub | high | <=6.4.1.0 | not stated |
| 2021-06-28 | Creation of order credits was not validated by acl in admin orders GHSA-g7w8-pp9w-7p32 · GitHub | low | <=6.4.1.0 | not stated |
| 2021-06-28 | Canceling of orders not related to the logged-in user GHSA-wq3r-jwrq-xg6w · GitHub | medium | <=6.4.1.0 | not stated |
| 2021-04-13 | After order payment process manipulation in shopware/platform and shopware/core GHSA-88rc-3p98-rgvx · GitHub | critical | <=6.3.5.2 | not stated |
| 2021-04-13 | Leak of information via Store-API aggregations in shopware/platform and shopware/core GHSA-qg7c-q3vq-rgxr · GitHub | critical | <=6.3.5.2 | not stated |
| 2020-12-21 | Authenticated Server Side Request Forgery GHSA-8pfh-mm2g-hmc3 · GitHub | low | <=6.3.4.0 | not stated |
| 2020-12-21 | Information exposure via query strings in URL GHSA-cq6h-w3mc-57f4 · GitHub | low | <=6.3.4.0 | not stated |
| 2020-12-21 | Authenticated Privilege Escalation GHSA-5q58-x5h2-v5rx · GitHub | low | <=6.3.4.0 | not stated |
| 2020-10-19 | Denial of Service via Cache Flooding GHSA-p68v-frgx-4rjp · GitHub | low | <=6.3.2.0 | not stated |
| 2020-10-19 | Authenticated XML External Entity Processing GHSA-8xv9-qcr9-ww9j · GitHub | medium | <=6.3.2.0 | not stated |
| 2020-09-23 | Non-persistent XSS in the Storefront in Shopware GHSA-qvhr-55hg-3qwv · GitHub | low | <=6.3.1.0 | not stated |
| 2020-09-23 | RCE in Third Party Library in Shopware GHSA-qvc5-cfrr-384v · GitHub | low | <=6.3.1.0 | not stated |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about shopware/core
Does shopware/core have known vulnerabilities?
Yes. Packagist lists 65 security advisories for shopware/core (5 critical, 16 high, 30 medium, 14 low severity). The most recent, reported 2026-06-04, is "Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation". The newest release, 6.7.16.0, is outside every affected range.
Which version of shopware/core should I run?
The newest stable release is 6.7.16.0 (published 2026-10-22). The most recent advisory is fixed in 6.7.10.1, so stay on or above the fixed version for your major version. Run composer update shopware/core, then composer audit to confirm nothing else is flagged.
How do I check if my shopware/core version is affected?
Run composer show shopware/core in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.