GHSA-qvc5-cfrr-384v

RCE in Third Party Library in Shopware

No scoreFix available

Impact

RCE in Third Party Library

Patches

We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020

What each source reports

GitHub AdvisoriesNo score

RCE in Third Party Library in Shopware

Impact

RCE in Third Party Library

Patches

We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020

Record: GHSA-qvc5-cfrr-384v
Updated: 2026-11-02

OSVNo score

RCE in Third Party Library in Shopware

Impact

RCE in Third Party Library

Patches

We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020

Record: GHSA-qvc5-cfrr-384v
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`shopware/platform` Packagist	through 6.3.1.0	6.3.1.1
`shopware/core` Packagist	through 6.3.1.0	6.3.1.1
`shopware/platform` Packagist	before 6.3.1.1, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.0v6.0.0+ea2 Show 16 moreShow less v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3	6.3.1.1
`shopware/core` Packagist	before 6.3.1.1, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.0v6.0.0+ea2 Show 16 moreShow less v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3	6.3.1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-qvc5-cfrr-384v is a vulnerability with no CVSS score yet in shopware/platform, published September 23, 2020. No source lists public exploit code. Fixed in shopware/platform 6.3.1.1.