Read the docs
TI-2021-22627 Aliases GHSA-3pcr-4982-548m

Exposure of .env if project root is configured as web root in shopware/production

Priority LOW 38CWE-552Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-552.

Summary

### Impact The .env and other sensitive files can be leaked if the project root and not `/public` is configured as the web root. ### Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ### Workarounds You should always use `/public` as the web root. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659 ### For more information https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021

Why it matters now

Fix Fixed shopware/production (Packagist): 6.3.5.3shopware/shopware (Packagist): 6.3.5.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—shopware/production (Packagist)before 6.3.5.36.3.5.3Patch availableGHSA-3pcr-4982-548m
—shopware/shopware (Packagist)before 6.3.5.36.3.5.3Patch availableGHSA-3pcr-4982-548m
  • shopware/production (Packagist) Vendor— Affected before 6.3.5.3 Fixed in 6.3.5.3 Patch available GHSA-3pcr-4982-548m
  • shopware/shopware (Packagist) Vendor— Affected before 6.3.5.3 Fixed in 6.3.5.3 Patch available GHSA-3pcr-4982-548m

Remediation

  • Fix · GHSA-3pcr-4982-548m shopware/production (Packagist) Fixed in 6.3.5.3 Advisory →
  • Fix · GHSA-3pcr-4982-548m shopware/shopware (Packagist) Fixed in 6.3.5.3 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-3pcr-4982-548m

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences