GHSA-q3g4-2vw9-xv27
Shopware Remote Code Execution Vulnerability
GHSA-q3g4-2vw9-xv27 is a critical vulnerability (CVSS 9.8) in shopware/shopware, published May 21, 2024. No source lists public exploit code. Fixed in shopware/shopware 5.2.15.
- Severity
- 9.8 CriticalCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.2.15shopware/shopware +3 more
Description
Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware. This is a critical security vulnerability that could affect the entire system. All Shopware versions including Shopware 5.2.14 are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/shopwarePackagist | 4.0.0 up to 5.2.15 | 5.2.15 |
shopware/shopwarePackagist | before 1.0.8 | 1.0.8 |
shopware/shopwarePackagist | 4.0.0 up to 5.2.15, plus listed versions 4.2.04.2.0-rc.14.2.14.2.1.14.2.2 Show 45 moreShow less4.2.34.3.04.3.14.3.24.3.34.3.44.3.54.3.64.3.7v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.0-RC2v5.0.0-RC3v5.0.1v5.0.2v5.0.2-RC1v5.0.3v5.0.3-RC1v5.0.4v5.0.4-RC1v5.1.0v5.1.0-RC2v5.1.0-RC3v5.1.1v5.1.2v5.1.2-RC1v5.1.2-RC2v5.1.3v5.1.3-RC1v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14 | 5.2.15 |
shopware/shopwarePackagist | before 1.0.8, plus listed versions 1.0.2 | 1.0.8 |
What each source reports
GitHub Advisories Score used
Shopware Remote Code Execution Vulnerability
Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware. This is a critical security vulnerability that could affect the entire system. All Shopware versions including Shopware 5.2.14 are affected.
- Record
GHSA-q3g4-2vw9-xv27- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Shopware Remote Code Execution Vulnerability
Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware. This is a critical security vulnerability that could affect the entire system. All Shopware versions including Shopware 5.2.14 are affected.
- Record
GHSA-q3g4-2vw9-xv27- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/shopware5/shopware/commit/14299e9ee9f7d93f687b4ec838e0873afbc84fec
community.shopware.com/_detail_1989.html
docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2017?category=shopware-5-en/security-updates
Left out here: 8 versions. The JSON record has them.