CVE-2026-23498

Shopware Improper Control of Generation of Code in Twig rendered views

State: Published
Severity: 7.2 High
Published: Jan 14, 2026
Updated: Jan 14, 2026
Reserved: Jan 13, 2026

Description

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
shopwareshopware	>= 6.7.0.0, < 6.7.6.1Affected

References

https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf
https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.