CVE-2026-23498: Shopware Improper Control of Generation of Code in Twig rendered views
Impact We fixed with CVE-2023-2017 Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override
Patches Patched in 6.7.6.1
Workarounds Install the security plugin
Other sources
Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23498?
CVE-2026-23498 has a high severity rating due to the potential for unauthorized execution of PHP functions.
How do I fix CVE-2026-23498?
To mitigate CVE-2026-23498, upgrade to version 6.7.6.1 of the affected packages in your Shopware installation.
What software is affected by CVE-2026-23498?
CVE-2026-23498 affects Shopware packages, specifically versions between 6.7.0.0 and 6.7.6.1.
What type of vulnerabilities are related to CVE-2026-23498?
CVE-2026-23498 is related to security issues with Twig filters that may allow unauthorized function execution.
Is there a workaround for CVE-2026-23498?
There is no official workaround for CVE-2026-23498; upgrading to the latest version is the recommended solution.