GHSA-3pcr-4982-548m

Exposure of .env if project root is configured as web root in shopware/production

No scoreFix available

Impact

The .env and other sensitive files can be leaked if the project root and not /public is configured as the web root.

Patches

We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

You should always use /public as the web root.

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021

What each source reports

GitHub AdvisoriesNo score

Exposure of .env if project root is configured as web root in shopware/production

Impact

The .env and other sensitive files can be leaked if the project root and not /public is configured as the web root.

Patches

We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

You should always use /public as the web root.

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021

Record: GHSA-3pcr-4982-548m
Weakness: CWE-552
Updated: 2026-11-02

OSVNo score

Exposure of .env if project root is configured as web root in shopware/production

Impact

The .env and other sensitive files can be leaked if the project root and not /public is configured as the web root.

Patches

We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

You should always use /public as the web root.

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021

Record: GHSA-3pcr-4982-548m
Weakness: CWE-552
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`shopware/production` Packagist	through 6.3.5.2	6.3.5.3
`shopware/shopware` Packagist	through 6.3.5.2	6.3.5.3
`shopware/production` Packagist	before 6.3.5.3, plus listed versions v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.1 Show 24 moreShow less v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3v6.3.0.0v6.3.0.1v6.3.0.2v6.3.1.0v6.3.1.1v6.3.2.0v6.3.2.1v6.3.3.0v6.3.3.1v6.3.4.0v6.3.4.1v6.3.5.0v6.3.5.1v6.3.5.2	6.3.5.3
`shopware/shopware` Packagist	before 6.3.5.3, plus listed versions 1.0.21.0.84.2.04.2.0-rc.14.2.1 Show 45 moreShow less 4.2.1.14.2.24.2.34.3.04.3.14.3.24.3.34.3.44.3.54.3.64.3.75.3.0v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.0-RC2v5.0.0-RC3v5.0.1v5.0.2v5.0.2-RC1v5.0.3v5.0.3-RC1v5.0.4v5.0.4-RC1v5.1.0v5.1.0-RC2v5.1.0-RC3v5.1.1v5.1.2v5.1.2-RC1v5.1.2-RC2v5.1.3v5.1.3-RC1v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11	6.3.5.3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-3pcr-4982-548m is a vulnerability with no CVSS score yet in shopware/production, published April 13, 2021. No source lists public exploit code. Fixed in shopware/production 6.3.5.3.

References

This page doesn't list everything

Left out here: 86 versions. The JSON record has them.