Read the docs
TI-2024-38721 Aliases GHSA-7336-ghhp-f2qj

Shopware Remote Code Execution Vulnerability

Priority LOW 38CWE-74Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware in versions prior to 5.2.16. One possible threat is if a template that doesn’t derive from the Shopware standard has been completely copied. Themes or plugins that execute or overwrite the following template code are vulnerable. - Affected file: emotion.tpl Path template file "Emotion template": templates / _default / frontend / forms / elements.tpl Path template file "Responsive template": themes/Frontend/Bare/frontend/forms/elements.tpl The complete line beginning with: `{eval var=$sSupport.sFields[$sKey]...` should be exchanged with the following: ``` {$sSupport.sFields[$sKey]|replace:'{literal}':''|replace:'{/literal}':''|replace:'%*%':"{s name='RequiredField' namespace='frontend/register/index'}{/s}"} ```

Why it matters now

Fix Fixed shopware/shopware (Packagist): 5.2.16

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—shopware/shopware (Packagist)5.2.15 to before 5.2.165.2.16Patch availableGHSA-7336-ghhp-f2qj
  • shopware/shopware (Packagist) Vendor— Affected 5.2.15 to before 5.2.16 Fixed in 5.2.16 Patch available GHSA-7336-ghhp-f2qj

Remediation

  • Fix · GHSA-7336-ghhp-f2qj shopware/shopware (Packagist) Fixed in 5.2.16 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7336-ghhp-f2qj

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences