Read the docs
TI-2024-28343 Aliases CVE-2024-42356GHSA-35jp-8cgg-p4wj

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Priority HIGH 71CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00648 51st percentileScored 2026-11-07
Fix Fixed shopware/core (Packagist): 6.5.8.13, 6.6.5.1shopware/platform (Packagist): 6.5.8.13, 6.6.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
shopwareshopwareup to 6.5.8.12; 6.6.0.0 – 6.6.5.0—No fix listedCNA
—shopware/core (Packagist)before 6.5.8.136.5.8.13Patch availableGHSA-35jp-8cgg-p4wj
—shopware/platform (Packagist)before 6.5.8.136.5.8.13Patch availableGHSA-35jp-8cgg-p4wj
—shopware/platform (Packagist)6.6.0.0 to before 6.6.5.16.6.5.1Patch availableGHSA-35jp-8cgg-p4wj
—shopware/core (Packagist)6.6.0.0 to before 6.6.5.16.6.5.1Patch availableGHSA-35jp-8cgg-p4wj
  • shopware Vendorshopware Affected up to 6.5.8.12; 6.6.0.0 – 6.6.5.0 Fixed in — No fix listed CNA
  • shopware/core (Packagist) Vendor— Affected before 6.5.8.13 Fixed in 6.5.8.13 Patch available GHSA-35jp-8cgg-p4wj
  • shopware/platform (Packagist) Vendor— Affected before 6.5.8.13 Fixed in 6.5.8.13 Patch available GHSA-35jp-8cgg-p4wj
  • shopware/platform (Packagist) Vendor— Affected 6.6.0.0 to before 6.6.5.1 Fixed in 6.6.5.1 Patch available GHSA-35jp-8cgg-p4wj
  • shopware/core (Packagist) Vendor— Affected 6.6.0.0 to before 6.6.5.1 Fixed in 6.6.5.1 Patch available GHSA-35jp-8cgg-p4wj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*before 6.5.8.13; 6.6.0.0 to before 6.6.5.1Vulnerableshopware
  • cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:* Versions before 6.5.8.13; 6.6.0.0 to before 6.6.5.1 Vulnerable ·shopware

Remediation

  • Fix · GHSA-35jp-8cgg-p4wj shopware/core (Packagist) Fixed in 6.5.8.13 Advisory →
  • Fix · GHSA-35jp-8cgg-p4wj shopware/platform (Packagist) Fixed in 6.5.8.13 Advisory →
  • Fix · GHSA-35jp-8cgg-p4wj shopware/platform (Packagist) Fixed in 6.6.5.1 Advisory →
  • Fix · GHSA-35jp-8cgg-p4wj shopware/core (Packagist) Fixed in 6.6.5.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42356
  2. 2026-10-03 Alias added: GHSA-35jp-8cgg-p4wj
  3. 2026-10-18 EPSS moved to the 50th–90th percentile

References

Patch 4

Advisory 2

Other 1

  • TI-2023-01895 Improper Control of Generation of Code in Twig Rendered Views in Shopware CVSS 3.1HIGH 8.8
  • TI-2025-20623 Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the… CVSS 3.1MEDIUM 6.8
  • TI-2019-09582 In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can… CVSS 3.1HIGH 8.8
  • TI-2016-02607 The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. CVSS 3.0CRITICAL 9.8
  • TI-2025-32365 A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation… CVSS 3.1MEDIUM 6.1
  • TI-2025-07276 Race Condition in Shopware Voucher Submission CVSS 4.0MEDIUM 6.0
See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences