Read the docs
TI-2026-24372 Aliases CVE-2026-31819GHSA-9ffx-f77r-756w

Sylius has an Open Redirect via Referer Header

Priority LOW 36CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's site as the Referer, and the application redirects back to it. This can be used for phishing or credential theft, as the redirect originates from a trusted domain. The severity varies by endpoint; public endpoints require no authentication and are trivially exploitable, while admin-only endpoints require an authenticated session but remain vulnerable if an admin follows a link from an external source such as email or chat. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed Sylius (Sylius): 2.2.3, 2.1.12, 2.0.16 +6sylius/sylius (Packagist): 1.9.12, 1.10.16, 1.11.17 +6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SyliusSylius2.2.0 to before 2.2.3; 2.1.0 to before 2.1.12; 2.0.0 to before 2.0.16; 1.14.0 to before 1.14.18; 1.13.0 to before 1.13.15; 1.12.0 to before 1.12.23; 1.11.0 to before 1.11.17; 1.10.0 to before 1.10.16; before 1.9.122.2.3, 2.1.12, 2.0.16, 1.14.18, 1.13.15, 1.12.23, 1.11.17, 1.10.16, 1.9.12Patch availableCNA
—sylius/sylius (Packagist)before 1.9.121.9.12Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)1.10.0 to before 1.10.161.10.16Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)1.11.0 to before 1.11.171.11.17Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)1.12.0 to before 1.12.231.12.23Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)1.13.0 to before 1.13.151.13.15Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)1.14.0 to before 1.14.181.14.18Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)2.0.0 to before 2.0.162.0.16Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)2.1.0 to before 2.1.122.1.12Patch availableGHSA-9ffx-f77r-756w
—sylius/sylius (Packagist)2.2.0 to before 2.2.32.2.3Patch availableGHSA-9ffx-f77r-756w
  • Sylius VendorSylius Affected 2.2.0 to before 2.2.3; 2.1.0 to before 2.1.12; 2.0.0 to before 2.0.16; 1.14.0 to before 1.14.18; 1.13.0 to before 1.13.15; 1.12.0 to before 1.12.23; 1.11.0 to before 1.11.17; 1.10.0 to before 1.10.16; before 1.9.12 Fixed in 2.2.3, 2.1.12, 2.0.16, 1.14.18, 1.13.15, 1.12.23, 1.11.17, 1.10.16, 1.9.12 Patch available CNA
  • sylius/sylius (Packagist) Vendor— Affected before 1.9.12 Fixed in 1.9.12 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 1.10.0 to before 1.10.16 Fixed in 1.10.16 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 1.11.0 to before 1.11.17 Fixed in 1.11.17 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 1.12.0 to before 1.12.23 Fixed in 1.12.23 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 1.13.0 to before 1.13.15 Fixed in 1.13.15 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 1.14.0 to before 1.14.18 Fixed in 1.14.18 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 2.0.0 to before 2.0.16 Fixed in 2.0.16 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 2.1.0 to before 2.1.12 Fixed in 2.1.12 Patch available GHSA-9ffx-f77r-756w
  • sylius/sylius (Packagist) Vendor— Affected 2.2.0 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-9ffx-f77r-756w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*before 1.9.12; 1.10.0 to before 1.10.16; 1.11.0 to before 1.11.17; 1.12.0 to before 1.12.23; 1.13.0 to before 1.13.15; 1.14.0 to before 1.14.18; 2.0.0 to before 2.0.16; 2.1.0 to before 2.1.12; 2.2.0 to before 2.2.3VulnerableSylius
  • cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:* Versions before 1.9.12; 1.10.0 to before 1.10.16; 1.11.0 to before 1.11.17; 1.12.0 to before 1.12.23; 1.13.0 to before 1.13.15; 1.14.0 to before 1.14.18; 2.0.0 to before 2.0.16; 2.1.0 to before 2.1.12; 2.2.0 to before 2.2.3 Vulnerable ·Sylius

Remediation

  • Fix · CNA Sylius (Sylius) Fixed in 2.2.3, 2.1.12, 2.0.16, 1.14.18, 1.13.15, 1.12.23, 1.11.17, 1.10.16, 1.9.12
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 1.9.12 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 1.10.16 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 1.11.17 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 1.12.23 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 1.13.15 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 1.14.18 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 2.0.16 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 2.1.12 Advisory →
  • Fix · GHSA-9ffx-f77r-756w sylius/sylius (Packagist) Fixed in 2.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31819
  2. 2026-10-03 Alias added: GHSA-9ffx-f77r-756w

References

Advisory 2

Other 1

  • TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2022-08557 Insufficient Session Expiration in Sylius CVSS 3.1HIGH 8.2
  • TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
  • TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
  • TI-2022-08563 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVSS 3.1MEDIUM 6.1
  • TI-2026-24377 Sylius has a Promotion Usage Limit Bypass via Race Condition CVSS 3.1HIGH 8.2
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences