Read the docs
TI-2024-38719 Aliases GHSA-q3g4-2vw9-xv27

Shopware Remote Code Execution Vulnerability

Priority LOW 38CWE-74Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware. This is a critical security vulnerability that could affect the entire system. All Shopware versions including Shopware 5.2.14 are affected.

Why it matters now

Fix Fixed shopware/shopware (Packagist): 5.2.15, 1.0.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—shopware/shopware (Packagist)4.0.0 to before 5.2.155.2.15Patch availableGHSA-q3g4-2vw9-xv27
—shopware/shopware (Packagist)before 1.0.81.0.8Patch availableGHSA-q3g4-2vw9-xv27
  • shopware/shopware (Packagist) Vendor— Affected 4.0.0 to before 5.2.15 Fixed in 5.2.15 Patch available GHSA-q3g4-2vw9-xv27
  • shopware/shopware (Packagist) Vendor— Affected before 1.0.8 Fixed in 1.0.8 Patch available GHSA-q3g4-2vw9-xv27

Remediation

  • Fix · GHSA-q3g4-2vw9-xv27 shopware/shopware (Packagist) Fixed in 5.2.15 Advisory →
  • Fix · GHSA-q3g4-2vw9-xv27 shopware/shopware (Packagist) Fixed in 1.0.8 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-q3g4-2vw9-xv27

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences