PKSA-78zd-mp8b-y5gw: Host header injection in the shop password reset e-mail link when the channel has no hostname
Published Oct 22, 2026
·Updated
Host header injection in the shop password reset e-mail link when the channel has no hostname
Affected Software
10 affected componentsFixes available
composer/sylius/sylius>=1.9.0, <1.10.0
composer/sylius/sylius>=1.10.0, <1.11.0
composer/sylius/sylius>=1.11.0, <1.12.0
composer/sylius/sylius>=1.12.0, <1.13.0
composer/sylius/sylius>=1.13.0, <1.14.0
composer/sylius/sylius>=1.14.0, <1.14.21
1.14.21
composer/sylius/sylius>=2.0.0, <2.1.0
composer/sylius/sylius>=2.1.0, <2.1.17
2.1.17
composer/sylius/sylius>=2.2.0, <2.2.12
2.2.12
composer/sylius/sylius>=2.3.0, <2.3.2
2.3.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 1.14.21 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.1.17 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.2.12 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Oct 22, 2026
Advisory Published
via Packagist·03:20 PM
Data Sourced
via Packagist·03:20 PM
DescriptionSeverityAffected Software