shopware/shopware

Shopware is the next generation of open source e-commerce software made in Germany

View on Packagist

View on Github

Activity

Latest release: 1y ago
Total releases: 133
Cadence: ~31 days
Last 12 months: 0

Reach

Stars: —

Details

License: AGPL-3.0 OR custom
First release: Jan 23, 2014

Releases

Version	Released
`v5.7.20` patch 1 CVE	Jun 05, 2025
`v5.7.19` patch 1 CVE	Sep 25, 2023
`v5.7.18` patch 1 CVE	Jun 27, 2023
`v5.7.17` patch 3 CVEs	Mar 21, 2023
`v5.7.17-RC1` pre 3 CVEs	Mar 13, 2023
`v5.7.16` patch 3 CVEs	Nov 02, 2022
`v5.7.16-RC1` pre 3 CVEs	Oct 10, 2022
`v5.7.15` patch 3 CVEs	Sep 08, 2022
`v5.7.14` patch 5 CVEs	Jul 18, 2022
`v5.7.13` patch 6 CVEs	Jun 22, 2022
`v5.7.12` patch 6 CVEs	Jun 22, 2022
`v5.7.11` patch 7 CVEs	May 09, 2022
`v5.7.10` patch 7 CVEs	Apr 29, 2022
`v5.7.9` patch 7 CVEs	Apr 27, 2022
`v5.7.8` patch 10 CVEs	Apr 05, 2022
`v5.7.7` patch 10 CVEs	Dec 29, 2021
`v5.7.6` patch 12 CVEs	Oct 25, 2021
`v5.7.5` patch 13 CVEs	Oct 19, 2021
`v5.7.4` patch 13 CVEs	Oct 12, 2021
`v5.7.3` patch 13 CVEs	Sep 08, 2021
`v5.7.2` patch 12 CVEs	Jun 24, 2021
`v5.7.1` patch 12 CVEs	Jun 18, 2021
`v5.7.0` minor 12 CVEs	May 26, 2021
`v5.7.0-RC2` pre 11 CVEs	May 12, 2021
`v5.6.10` patch 11 CVEs	May 04, 2021
`v5.7.0-RC1` pre 11 CVEs	Nov 10, 2020
`v5.6.9` patch 15 CVEs	Nov 06, 2020
`v5.6.8` patch 18 CVEs	Aug 12, 2020
`v5.6.7` patch 18 CVEs	Jun 02, 2020
`v5.6.6` patch 18 CVEs	Mar 03, 2020
`v5.6.5` patch 18 CVEs	Feb 27, 2020
`v5.6.4` patch 18 CVEs	Dec 17, 2019
`v5.6.3` patch 18 CVEs	Nov 27, 2019
`v5.6.2` patch 18 CVEs	Sep 24, 2019
`v5.6.1` patch 18 CVEs	Aug 26, 2019
`v5.6.0` minor 19 CVEs	Aug 09, 2019
`v5.6.0-RC1` pre 18 CVEs	Jul 08, 2019
`v5.5.10` patch 19 CVEs	Jun 05, 2019
`v5.5.9` patch 19 CVEs	May 28, 2019
`v5.5.8` patch 19 CVEs	Apr 01, 2019
`v5.5.7` patch 20 CVEs	Feb 25, 2019
`v5.5.6` patch 20 CVEs	Jan 21, 2019
`v5.5.5` patch 20 CVEs	Jan 18, 2019
`v5.5.4` patch 20 CVEs	Nov 30, 2018
`v5.5.3` patch 20 CVEs	Oct 30, 2018
`v5.5.2` patch 20 CVEs	Oct 17, 2018
`v5.5.1` patch 20 CVEs	Sep 18, 2018
`v5.5.0` minor 20 CVEs	Sep 17, 2018
`v5.5.0-RC1` pre 20 CVEs	Aug 06, 2018
`v5.4.6` patch 20 CVEs	Jul 18, 2018

1–50 of 133

Repository

shopware5/shopware

Forks: —
Open issues: —

Dependencies (52)

Depends on

v5.7.20

Used by

Supply-chain exposure

17 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (34)

CVE-2026-23498 GHSA-7cw6-7h3h-v8pf Jan 14, 2026

Shopware Has Improper Control of Generation of Code in Twig rendered views

7.2 / 10
High
Network Low High None Unchanged High High High

Impact

We fixed with CVE-2023-2017 Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override

Patches

Patched in 6.7.6.1

Workarounds

Install the security plugin

Fixed in

6.7.6.1

References

https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf
https://nvd.nist.gov/vuln/detail/CVE-2026-23498
https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475
https://github.com/advisories/GHSA-7v2v-9rm4-7m8f
https://github.com/shopware/shopware

Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-67648 GHSA-6w82-v552-wjw2 Dec 09, 2025

Shopware Storefront Reflected XSS in Storefront Login Page

7.1 / 10
High
Network Low None Required Unchanged Low High None

Impact

By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.

Description

A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter waitTime lacks proper input validation.

The attack can be tested with the following URL pattern:

/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>

The same applies to the errorSnippet parameter:

/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.

Fixed in

6.6.10.106.7.5.1

References

https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2
https://nvd.nist.gov/vuln/detail/CVE-2025-67648
https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58
https://github.com/shopware/shopware

Updated Sep 10, 2026 · Source: OSV.dev
GHSA-9v82-vcjx-m76j Sep 10, 2025

Shopware: Reflective Cross Site-Scripting (XSS) in CMS components

8.8 / 10
High
Network Low None Required Changed High Low Low

Impact

By exploiting XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user.

Some examples of this include, but are not limited to:

Obtaining user session tokens.

Performing administrative actions (when an administrative user is affected).

These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.

Description

When an application uses input fields, it is important that user input is adequately filtered for malicious HTML and JavaScript characters. When adequate input validation is not applied, Cross-Site Scripting (XSS) vulnerabilities may arise. These allow malicious actors to inject malicious code into application pages. When a user visits the page, the code is executed in the user's web browser. This allows malicious actors to perform malicious actions in the name of that user. XSS can be divided into three variants: Persistent XSS, Reflective XSS and DOM-based XSS. In Reflective XSS, a malicious actor injects malicious JavaScript code into a URL. Every time the user visits this URL, the JavaScript code is executed in the user’s browser.

Applicability

Due to a lack of input validation, the Shopware application contain XSS vulnerabilities. The JavaScript variable 'activeRouteParameters' lacks input validation, which makes it vulnerable to XSS attacks at the following endpoints:

/page/cms/*

/widget/cms/*

The lack of input validation enables malicious actors to inject harmful JavaScript-code into the affected pages. When a user visits the page, the code is executed within the user’s web browser. This enables malicious actors to perform (harmful) actions on behalf of the affected user. No user account is required to exploit this vulnerability.

Reproduction

To reproduce this vulnerability, the steps below can be followed.

Navigate to the URL below containing the XSS payload: https://pentest-saas-2025-2.shopware.store/page/cms/'+alert('REQON')+'

Observe that a pop-up is shown indicating that the JavaScript code has been executed.

Workarounds

For older versions of 6.7, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Fixed in

6.7.2.1

References

https://github.com/shopware/shopware/security/advisories/GHSA-9v82-vcjx-m76j
https://github.com/shopware/shopware/commit/12fb537c5ebe009f2a0f58b9c24dbd2d6b4c508f
https://github.com/shopware/shopware
https://github.com/shopware/shopware/releases/tag/v6.7.2.1

Updated Sep 10, 2025 · Source: OSV.dev
GHSA-83jv-4prm-34g7 May 21, 2024

Shopware Remote Code Execution Vulnerability

9.8 / 10
Critical
Network Low None None Unchanged High High High

Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.

Affected versions

4.2.04.2.14.2.1.14.2.24.2.34.3.04.3.14.3.24.3.34.3.44.3.54.3.6

+ 55 more Show less

4.3.7v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.0-RC2v5.0.0-RC3v5.0.1v5.0.2v5.0.2-RC1v5.0.3v5.0.3-RC1v5.0.4v5.0.4-RC1v5.1.0v5.1.0-RC2v5.1.0-RC3v5.1.1v5.1.2v5.1.2-RC1v5.1.2-RC2v5.1.3v5.1.3-RC1v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14v5.2.15v5.2.16v5.2.17v5.2.18v5.2.19v5.2.2v5.2.20v5.2.21v5.2.22v5.2.23v5.2.24v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9

Fixed in

5.2.25

References

https://github.com/shopware5/shopware/commit/8f6a7cefcba7547276892b82f64e4874c1a0dfed
https://community.shopware.com/_detail_2015.html
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2017?category=shopware-5-en/security-updates
https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2017-06-22.yaml
https://github.com/shopware5/shopware

Updated Dec 06, 2024 · Source: OSV.dev
GHSA-7336-ghhp-f2qj May 21, 2024

Shopware Remote Code Execution Vulnerability

9.8 / 10
Critical
Network Low None None Unchanged High High High

Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware in versions prior to 5.2.16. One possible threat is if a template that doesn’t derive from the Shopware standard has been completely copied. Themes or plugins that execute or overwrite the following template code are vulnerable.

Affected file: emotion.tpl

Path template file "Emotion template": templates / _default / frontend / forms / elements.tpl Path template file "Responsive template": themes/Frontend/Bare/frontend/forms/elements.tpl

The complete line beginning with: {eval var=$sSupport.sFields[$sKey]... should be exchanged with the following:

{$sSupport.sFields[$sKey]|replace:'{literal}':''|replace:'{/literal}':''|replace:'%*%':"{s name='RequiredField' namespace='frontend/register/index'}{/s}"}

Affected versions

5.2.15v5.2.15

Fixed in

5.2.16

References

https://github.com/shopware5/shopware/commit/6113d30a90e626154e438aa896e656c0f38694f3
https://community.shopware.com/_detail_1989.html
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2017?category=shopware-5-en/security-updates
https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2017-01-25.yaml
https://github.com/shopware5/shopware

Updated Dec 06, 2024 · Source: OSV.dev
GHSA-jqr7-5h7r-ch8p May 21, 2024

Shopware Non-Persistent XSS in the Frontend

6.1 / 10
Medium
Network Low None Required Changed Low Low None

A non-persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Shopware eCommerce platform within the frontend. This vulnerability may allow an attacker to inject and execute malicious scripts in the context of a victim's web browser.

Affected versions

5.3.0v5.2.0v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14v5.2.15v5.2.16v5.2.17v5.2.18

+ 20 more Show less

v5.2.19v5.2.2v5.2.20v5.2.21v5.2.22v5.2.23v5.2.24v5.2.25v5.2.26v5.2.27v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9v5.3.4v5.3.5v5.3.6

Fixed in

5.3.7

References

https://github.com/shopware5/shopware/commit/54461aa651566dc2701b873fe6bd94589604751b
https://community.shopware.com/_detail_2048.html
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2018?category=shopware-5-en/security-updates
https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2018-01-22.yaml
https://github.com/shopware5/shopware

Updated Dec 06, 2024 · Source: OSV.dev
GHSA-q3g4-2vw9-xv27 May 21, 2024

Shopware Remote Code Execution Vulnerability

9.8 / 10
Critical
Network Low None None Unchanged High High High

Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware. This is a critical security vulnerability that could affect the entire system. All Shopware versions including Shopware 5.2.14 are affected.

Affected versions

4.2.04.2.0-rc.14.2.14.2.1.14.2.24.2.34.3.04.3.14.3.24.3.34.3.44.3.5

+ 47 more Show less

4.3.64.3.7v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.0-RC2v5.0.0-RC3v5.0.1v5.0.2v5.0.2-RC1v5.0.3v5.0.3-RC1v5.0.4v5.0.4-RC1v5.1.0v5.1.0-RC2v5.1.0-RC3v5.1.1v5.1.2v5.1.2-RC1v5.1.2-RC2v5.1.3v5.1.3-RC1v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14v5.2.2v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.91.0.2

Fixed in

1.0.85.2.15

References

https://github.com/shopware5/shopware/commit/14299e9ee9f7d93f687b4ec838e0873afbc84fec
https://community.shopware.com/_detail_1989.html
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2017?category=shopware-5-en/security-updates
https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2017-01-24.yaml
https://github.com/shopware5/shopware

Updated Dec 06, 2024 · Source: OSV.dev
CVE-2023-34099 GHSA-gh66-fp7j-98v5 Jun 28, 2023

Shopware improper mail validation vulnerability

5.3 / 10
Medium
Network Low None None Unchanged None Low None

Impact

The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts.

Patches

We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023

Affected versions

5.3.0v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11

+ 83 more Show less

v5.2.12v5.2.13v5.2.14v5.2.15v5.2.16v5.2.17v5.2.18v5.2.19v5.2.2v5.2.20v5.2.21v5.2.22v5.2.23v5.2.24v5.2.25v5.2.26v5.2.27v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9v5.3.4v5.3.5v5.3.6v5.3.7v5.4.0v5.4.0-RC1v5.4.1v5.4.2v5.4.3v5.4.4v5.4.5v5.4.6v5.5.0v5.5.0-BETA1v5.5.0-RC1v5.5.1v5.5.10v5.5.2v5.5.3v5.5.4v5.5.5v5.5.6v5.5.7v5.5.8v5.5.9v5.6.0v5.6.0-RC1v5.6.1v5.6.10v5.6.2v5.6.3v5.6.4v5.6.5v5.6.6v5.6.7v5.6.8v5.6.9v5.7.0v5.7.0-RC1v5.7.0-RC2v5.7.1v5.7.10v5.7.11v5.7.12v5.7.13v5.7.14v5.7.15v5.7.16v5.7.16-RC1v5.7.17v5.7.17-RC1v5.7.2v5.7.3v5.7.4v5.7.5v5.7.6v5.7.7v5.7.8v5.7.9

Fixed in

5.7.18

References

https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5
https://github.com/shopware5/shopware/security/advisories/GHSA-gh66-fp7j-98v5
https://nvd.nist.gov/vuln/detail/CVE-2023-34099
https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
https://github.com/shopware5/shopware

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2023-34098 GHSA-q97c-2mh3-pgw9 Jun 28, 2023

Shopware dependency configuration exposed

5.3 / 10
Medium
Network Low None None Unchanged Low None None

Impact

Due to a wrong configuration in the .htaccess file, the configuration file of Javascript dependencies could be read in production environments (themes/package-lock.json). With this information, the used Shopware version might be determined by an attacker, which could be used for further attacks.

Patches

We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023

Affected versions

v5.6.0v5.6.1v5.6.10v5.6.2v5.6.3v5.6.4v5.6.5v5.6.6v5.6.7v5.6.8v5.6.9v5.7.0

+ 21 more Show less

v5.7.0-RC1v5.7.0-RC2v5.7.1v5.7.10v5.7.11v5.7.12v5.7.13v5.7.14v5.7.15v5.7.16v5.7.16-RC1v5.7.17v5.7.17-RC1v5.7.2v5.7.3v5.7.4v5.7.5v5.7.6v5.7.7v5.7.8v5.7.9

Fixed in

5.7.18

References

https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9
https://github.com/shopware5/shopware/security/advisories/GHSA-q97c-2mh3-pgw9
https://nvd.nist.gov/vuln/detail/CVE-2023-34098
https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
https://github.com/shopware5/shopware

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2022-48150 GHSA-mj9r-fpv3-rgfx Apr 21, 2023

Shopware vulnerable to cross-site scripting (XSS)

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.

Affected versions

1.0.21.0.84.2.04.2.0-rc.14.2.14.2.1.14.2.24.2.34.3.04.3.14.3.24.3.3

+ 87 more Show less

4.3.44.3.54.3.64.3.75.3.0v5.0.0v5.0.0-BETA1v5.0.0-BETA2v5.0.0-RC1v5.0.0-RC2v5.0.0-RC3v5.0.1v5.0.2v5.0.2-RC1v5.0.3v5.0.3-RC1v5.0.4v5.0.4-RC1v5.1.0v5.1.0-RC2v5.1.0-RC3v5.1.1v5.1.2v5.1.2-RC1v5.1.2-RC2v5.1.3v5.1.3-RC1v5.1.4v5.1.5v5.1.6v5.2.0v5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14v5.2.15v5.2.16v5.2.17v5.2.18v5.2.19v5.2.2v5.2.20v5.2.21v5.2.22v5.2.23v5.2.24v5.2.25v5.2.26v5.2.27v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9v5.3.4v5.3.5v5.3.6v5.3.7v5.4.0v5.4.0-RC1v5.4.1v5.4.2v5.4.3v5.4.4v5.4.5v5.4.6v5.5.0v5.5.0-BETA1v5.5.0-RC1v5.5.1v5.5.10v5.5.2v5.5.3v5.5.4v5.5.5v5.5.6v5.5.7v5.5.8v5.5.9

References

https://nvd.nist.gov/vuln/detail/CVE-2022-48150
https://github.com/sahilop123/-CVE-2022-48150
https://github.com/shopware/shopware

Updated Feb 05, 2025 · Source: OSV.dev

1–10 of 34

Insights

Releases per month

last 12 months

Release mix

major 2
minor 8
patch 99
pre 23

133 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2025

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More