{"id":"CVE-2026-23498","aliases":["EUVD-2026-2421","GHSA-7cw6-7h3h-v8pf"],"status":"published","title":"Shopware Improper Control of Generation of Code in Twig rendered views","description":"Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00442,"percentile":0.38843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2026-01-14T16:54:27Z","modified":"2026-10-28T02:30:27Z","exploits":[{"source":"pocgithub","id":"lukasz-rybak/CVE-2026-23498","title":"lukasz-rybak/CVE-2026-23498","date":"2026-04-11","url":"https://github.com/lukasz-rybak/CVE-2026-23498"}],"fixes":[{"ecosystem":"Packagist","package":"shopware/shopware","fixed_in":["6.7.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"shopware/core","fixed_in":["6.7.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"shopware/shopware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.6.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.6.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shopware/shopware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.6.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.6.1"}]}],"versions":["v6.7.0.0","v6.7.0.1","v6.7.1.0","v6.7.1.1","v6.7.1.2","v6.7.2.0","v6.7.2.1","v6.7.2.2","v6.7.3.0","v6.7.3.1","v6.7.4.0","v6.7.4.1","v6.7.4.2","v6.7.5.0","v6.7.5.1","v6.7.6.0"]}],"products":[{"vendor":"shopware","product":"shopware"}],"references":[{"url":"https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/advisories/GHSA-7v2v-9rm4-7m8f","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23498","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7cw6-7h3h-v8pf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23498.json","tags":["advisory"]},{"url":"https://github.com/shopware/shopware","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-23498","title":"Shopware Improper Control of Generation of Code in Twig rendered views","description":"Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.","status":"published","published":"2026-01-14T18:31:19.07Z","modified":"2026-01-14T21:15:57.391Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-2421","description":"Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.","status":"published","published":"2026-01-14T18:31:19Z","modified":"2026-01-14T21:15:57Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:51.744142Z"}],"ghsa":[{"id":"GHSA-7cw6-7h3h-v8pf","title":"Shopware Has Improper Control of Generation of Code in Twig rendered views","description":"### Impact\nWe fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override\n\n### Patches\nPatched in 6.7.6.1\n\n### Workarounds\nInstall the security plugin","status":"published","published":"2026-01-14T16:54:27Z","modified":"2026-01-14T21:46:48Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:17.333958Z"}],"nvd":[{"id":"CVE-2026-23498","description":"Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.","status":"published","published":"2026-01-14T19:16:48.43Z","modified":"2026-06-17T10:21:41.823Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"CVE-2026-23498","title":"Shopware Improper Control of Generation of Code in Twig rendered views","description":"Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.","status":"published","published":"2026-01-14T18:31:19.07Z","modified":"2026-10-28T02:30:27.777326795Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"GHSA-7cw6-7h3h-v8pf","title":"Shopware Has Improper Control of Generation of Code in Twig rendered views","description":"### Impact\nWe fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override\n\n### Patches\nPatched in 6.7.6.1\n\n### Workarounds\nInstall the security plugin","status":"published","published":"2026-01-14T16:54:27Z","modified":"2026-02-03T02:56:25.126713Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}