Read the docs
TI-2026-19301 Aliases CVE-2026-23959GHSA-fqcv-8859-86x2

CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

Priority MEDIUM 64CWE-564Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. Version 4.1.9 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed CoreShop (coreshop): 4.1.9coreshop/core-shop (Packagist): 4.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
coreshopCoreShopbefore 4.1.94.1.9Patch availableCNA
—coreshop/core-shop (Packagist)before 4.1.94.1.9Patch availableGHSA-fqcv-8859-86x2
  • CoreShop Vendorcoreshop Affected before 4.1.9 Fixed in 4.1.9 Patch available CNA
  • coreshop/core-shop (Packagist) Vendor— Affected before 4.1.9 Fixed in 4.1.9 Patch available GHSA-fqcv-8859-86x2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:coreshop:coreshop:*:*:*:*:*:*:*:*before 4.1.9Vulnerablecoreshop
  • cpe:2.3:a:coreshop:coreshop:*:*:*:*:*:*:*:* Versions before 4.1.9 Vulnerable ·coreshop

Remediation

  • Fix · CNA CoreShop (coreshop) Fixed in 4.1.9
  • Fix · GHSA-fqcv-8859-86x2 coreshop/core-shop (Packagist) Fixed in 4.1.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23959
  2. 2026-10-03 Alias added: GHSA-fqcv-8859-86x2

References

Patch 1

Advisory 2

Other 2

  • TI-2026-17852 CoreShop Vulnerable to SQL Injection via Admin Reports CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences