Read the docs
TI-2020-04274 Aliases CVE-2020-5218GHSA-prg5-hg25-8grq

Ability in Sylius to switch channels via GET parameter enabled in production environments

Priority LOW 21CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false. Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore.

Why it matters now

EPSS 0.00595 48th percentileScored 2026-11-07
Fix Fixed Sylius (Sylius): 1.3.13, 1.4.6, 1.5.1 +1sylius/sylius (Packagist): 1.3.16, 1.4.12, 1.5.9 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SyliusSyliusbefore 1.3.13; 1.4.0 to before 1.4.6; 1.5.0 to before 1.5.1; 1.6.0 to before 1.6.31.3.13, 1.4.6, 1.5.1, 1.6.3Patch availableCNA
—sylius/sylius (Packagist)before 1.3.161.3.16Patch availableGHSA-prg5-hg25-8grq
—sylius/sylius (Packagist)1.4.0 to before 1.4.121.4.12Patch availableGHSA-prg5-hg25-8grq
—sylius/sylius (Packagist)1.5 to before 1.5.91.5.9Patch availableGHSA-prg5-hg25-8grq
—sylius/sylius (Packagist)1.6.0 to before 1.6.51.6.5Patch availableGHSA-prg5-hg25-8grq
  • Sylius VendorSylius Affected before 1.3.13; 1.4.0 to before 1.4.6; 1.5.0 to before 1.5.1; 1.6.0 to before 1.6.3 Fixed in 1.3.13, 1.4.6, 1.5.1, 1.6.3 Patch available CNA
  • sylius/sylius (Packagist) Vendor— Affected before 1.3.16 Fixed in 1.3.16 Patch available GHSA-prg5-hg25-8grq
  • sylius/sylius (Packagist) Vendor— Affected 1.4.0 to before 1.4.12 Fixed in 1.4.12 Patch available GHSA-prg5-hg25-8grq
  • sylius/sylius (Packagist) Vendor— Affected 1.5 to before 1.5.9 Fixed in 1.5.9 Patch available GHSA-prg5-hg25-8grq
  • sylius/sylius (Packagist) Vendor— Affected 1.6.0 to before 1.6.5 Fixed in 1.6.5 Patch available GHSA-prg5-hg25-8grq

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*1.3.0 to before 1.3.13; 1.4.0 to before 1.4.6; 1.6.0 to before 1.6.3VulnerableSylius
cpe:2.3:a:sylius:sylius:1.5.0:-:*:*:*:*:*:*1.5.0VulnerableSylius
  • cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:* Versions 1.3.0 to before 1.3.13; 1.4.0 to before 1.4.6; 1.6.0 to before 1.6.3 Vulnerable ·Sylius
  • cpe:2.3:a:sylius:sylius:1.5.0:-:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Sylius

Remediation

  • Fix · CNA Sylius (Sylius) Fixed in 1.3.13, 1.4.6, 1.5.1, 1.6.3
  • Fix · GHSA-prg5-hg25-8grq sylius/sylius (Packagist) Fixed in 1.3.16 Advisory →
  • Fix · GHSA-prg5-hg25-8grq sylius/sylius (Packagist) Fixed in 1.4.12 Advisory →
  • Fix · GHSA-prg5-hg25-8grq sylius/sylius (Packagist) Fixed in 1.5.9 Advisory →
  • Fix · GHSA-prg5-hg25-8grq sylius/sylius (Packagist) Fixed in 1.6.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5218
  2. 2026-10-03 Alias added: GHSA-prg5-hg25-8grq

References

Patch 1

Advisory 2

Other 1

  • TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
  • TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
  • TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
  • TI-2022-08563 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVSS 3.1MEDIUM 6.1
  • TI-2026-24377 Sylius has a Promotion Usage Limit Bypass via Race Condition CVSS 3.1HIGH 8.2
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences