GHSA-83jv-4prm-34g7
Shopware Remote Code Execution Vulnerability
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
Shopware Remote Code Execution Vulnerability
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
- Record
GHSA-83jv-4prm-34g7- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSV
Shopware Remote Code Execution Vulnerability
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
- Record
GHSA-83jv-4prm-34g7- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/shopwarePackagist | 4.2.0 up to 5.2.25 | 5.2.25 |
shopware/shopwarePackagist | 4.2.0 up to 5.2.25, plus listed versions 4.2.14.2.1.14.2.24.2.34.3.0 Show 45 moreShow less4.3.14.3.24.3.34.3.44.3.54.3.64.3.7v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.0-RC2v5.0.0-RC3v5.0.1v5.0.2v5.0.2-RC1v5.0.3v5.0.3-RC1v5.0.4v5.0.4-RC1v5.1.0v5.1.0-RC2v5.1.0-RC3v5.1.1v5.1.2v5.1.2-RC1v5.1.2-RC2v5.1.3v5.1.3-RC1v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14v5.2.15v5.2.16 | 5.2.25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-83jv-4prm-34g7 is a critical vulnerability (CVSS 9.8) in shopware/shopware, published May 21, 2024. No source lists public exploit code. Fixed in shopware/shopware 5.2.25.
References
github.com/shopware5/shopware/commit/8f6a7cefcba7547276892b82f64e4874c1a0dfed
community.shopware.com/_detail_2015.html
docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2017?category=shopware-5-en/security-updates
Left out here: 16 versions. The JSON record has them.