shopware/storefront

Storefront for Shopware

View on Packagist

View on Github

Activity

Latest release: 5d ago
Total releases: 213
Cadence: ~6 days
Last 12 months: 46

Reach

Stars: 67

Details

License: MIT
First release: Oct 14, 2019

Releases

Version	Released
`v6.6.10.24` patch	Sep 10, 2026
`v6.7.14.0` patch	Sep 09, 2026
`v6.6.10.23` patch	Aug 25, 2026
`v6.7.13.1` patch	Aug 25, 2026
`v6.6.10.22` patch	Aug 05, 2026
`v6.7.13.0` patch	Aug 05, 2026
`v6.6.10.21` patch	Jul 23, 2026
`v6.7.12.2` patch	Jul 23, 2026
`v6.6.10.20` patch	Jul 07, 2026
`v6.7.12.1` patch	Jul 07, 2026
`v6.7.11.1` patch	Jun 23, 2026
`v6.6.10.19` patch	Jun 16, 2026
`v6.7.11.0` patch	Jun 16, 2026
`v6.5.8.19` patch 1 CVE	Jun 02, 2026
`v6.7.10.2` patch	Jun 01, 2026
`v6.6.10.18` patch	May 19, 2026
`v6.7.10.1` patch	May 19, 2026
`v6.6.10.17` patch	May 07, 2026
`v6.7.10.0` patch	May 06, 2026
`v6.7.9.1` patch	Apr 27, 2026
`v6.6.10.16` patch	Apr 17, 2026
`v6.7.9.0` patch	Apr 16, 2026
`v6.7.8.2` patch	Mar 18, 2026
`v6.6.10.15` patch	Mar 11, 2026
`v6.7.8.1` patch	Mar 11, 2026
`v6.6.10.14` patch	Mar 05, 2026
`v6.7.8.0` patch	Mar 03, 2026
`v6.6.10.13` patch	Feb 05, 2026
`v6.7.7.1` patch	Feb 05, 2026
`v6.6.10.12` patch	Feb 04, 2026
`v6.7.7.0` patch	Feb 02, 2026
`v6.7.6.2` patch	Jan 20, 2026
`v6.6.10.11` patch	Jan 16, 2026
`v6.7.6.1` patch	Jan 14, 2026
`v6.7.6.0` patch	Jan 13, 2026
`v6.6.10.10` patch	Dec 09, 2025
`v6.7.5.1` patch	Dec 09, 2025
`v6.7.5.0` patch 1 CVE	Dec 02, 2025
`v6.7.4.2` patch 1 CVE	Nov 14, 2025
`v6.7.4.1` patch 1 CVE	Nov 12, 2025
`v6.6.10.9` patch 1 CVE	Nov 12, 2025
`v6.7.4.0` patch 1 CVE	Nov 04, 2025
`v6.6.10.8` patch 1 CVE	Oct 28, 2025
`v6.6.10.7` patch 1 CVE	Oct 21, 2025
`v6.7.3.1` patch 1 CVE	Oct 21, 2025
`v6.7.3.0` patch 1 CVE	Oct 06, 2025
`v6.7.2.2` patch 1 CVE	Sep 15, 2025
`v6.7.2.1` patch 1 CVE	Sep 09, 2025
`v6.7.2.0` patch 1 CVE	Sep 01, 2025
`v6.7.1.2` patch 1 CVE	Jul 31, 2025

1–50 of 213

Repository

shopware/storefront

Forks: 36
Open issues: 0
Language: JavaScript

Dependencies (25)

Depends on

v6.6.10.24

Used by

171

Supply-chain exposure

171 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (5)

CVE-2025-67648 GHSA-6w82-v552-wjw2 Dec 09, 2025

Shopware Storefront Reflected XSS in Storefront Login Page

7.1 / 10
High
Network Low None Required Unchanged Low High None

Impact

By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.

Description

A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter waitTime lacks proper input validation.

The attack can be tested with the following URL pattern:

/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>

The same applies to the errorSnippet parameter:

/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.

Affected versions

6.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.1

+ 114 more Show less

6.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.20.06.4.20.16.4.20.26.4.6.06.4.6.16.4.7.06.4.8.06.4.8.16.4.8.26.4.9.06.5.0.06.5.0.0-rc16.5.0.0-rc26.5.0.0-rc36.5.0.0-rc4v6.5.1.0v6.5.1.1v6.5.2.0v6.5.2.1v6.5.3.0v6.5.3.1v6.5.3.2v6.5.3.3v6.5.4.0v6.5.4.1v6.5.5.0v6.5.5.1v6.5.5.2v6.5.6.0v6.5.6.1v6.5.7.0v6.5.7.1v6.5.7.2v6.5.7.3v6.5.7.4v6.5.8.0v6.5.8.1v6.5.8.10v6.5.8.11v6.5.8.12v6.5.8.13v6.5.8.14v6.5.8.15v6.5.8.16v6.5.8.17v6.5.8.18v6.5.8.19v6.5.8.2v6.5.8.3v6.5.8.4v6.5.8.5v6.5.8.6v6.5.8.7v6.5.8.8v6.5.8.9v6.6.0.0v6.6.0.0-rc1v6.6.0.0-rc2v6.6.0.0-rc3v6.6.0.0-rc4v6.6.0.0-rc5v6.6.0.0-rc6v6.6.0.0-rc7v6.6.0.1v6.6.0.2v6.6.0.3v6.6.1.0v6.6.1.1v6.6.1.2v6.6.10.0v6.6.10.1v6.6.10.2v6.6.10.3v6.6.10.4v6.6.10.5v6.6.10.6v6.6.10.7v6.6.10.8v6.6.10.9v6.6.2.0v6.6.3.0v6.6.3.1v6.6.4.0v6.6.4.1v6.6.5.0v6.6.5.1v6.6.6.0v6.6.6.1v6.6.7.0v6.6.7.1v6.6.8.0v6.6.8.1v6.6.8.2v6.6.9.0v6.7.0.0v6.7.0.1v6.7.1.0v6.7.1.1v6.7.1.2v6.7.2.0v6.7.2.1v6.7.2.2v6.7.3.0v6.7.3.1v6.7.4.0v6.7.4.1v6.7.4.2v6.7.5.0

Fixed in

6.6.10.106.7.5.1

References

https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2
https://nvd.nist.gov/vuln/detail/CVE-2025-67648
https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58
https://github.com/shopware/shopware

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-27917 GHSA-c2f9-4jmm-v45m Mar 06, 2024

Shopware's session is persistent in Cache for 404 pages

7.5 / 10
High
Network Low None None Unchanged None High None

Impact

The Symfony Session Handler, pop's the Session Cookie and assign it to the Response. Since Shopware 6.5.8.0 the 404 pages, are cached, to improve the performance of 404 pages. So the cached Response, contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used.

Patches

Update to Shopware version 6.5.8.7

Workarounds

Using Redis for Sessions, as this does not trigger the exploit code. Example configuration for Redis

# php.ini session.save_handler = redis session.save_path = "tcp://127.0.0.1:6379"

Consequences

As an guest browser session has been cached on a 404 page, every missing image or directly reaching a 404 page will logout the customer or clear his cart.

Affected versions

v6.5.8.0v6.5.8.1v6.5.8.2v6.5.8.3v6.5.8.4v6.5.8.5v6.5.8.6

Fixed in

6.5.8.7

References

https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m
https://github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3
https://github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e
https://github.com/shopware/shopware
https://github.com/shopware/shopware/releases/tag/v6.5.8.7

Updated Feb 22, 2026 · Source: OSV.dev
CVE-2022-24747 GHSA-6wrh-279j-6hvw Mar 10, 2022

HTTP caching is marking private HTTP headers as public in Shopware

6.3 / 10
Medium
Network High Low None Changed High None None

Impact

HTTP caching is marking private HTTP headers as public

Patches

Fixed in recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Affected versions

6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.16.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.0

+ 39 more Show less

6.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.2.06.4.2.16.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.16.4.6.06.4.6.16.4.7.06.4.8.06.4.8.1v6.0.0+ea2v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3

Fixed in

6.4.8.2

References

https://github.com/shopware/platform/security/advisories/GHSA-6wrh-279j-6hvw
https://nvd.nist.gov/vuln/detail/CVE-2022-24747
https://github.com/shopware/platform/commit/d51863148f32306aafdbc7f9f48887c69fce206f
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022
https://github.com/shopware/platform

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2022-24746 GHSA-952p-fqcp-g8pc Mar 10, 2022

HTML injection possibility in voucher code form in Shopware

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Impact

HTML injection possibility in voucher code form

Patches

Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Affected versions

6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.16.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.0

+ 38 more Show less

6.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.2.06.4.2.16.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.16.4.6.06.4.6.16.4.7.06.4.8.0v6.0.0+ea2v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3

Fixed in

6.4.8.1

References

https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pc
https://nvd.nist.gov/vuln/detail/CVE-2022-24746
https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022?category=security-updates
https://github.com/shopware/platform

Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-24745 GHSA-jp6h-mxhx-pgqh Mar 10, 2022

Shopware guest session is shared between customers

4.8 / 10
Medium
Network High None None Unchanged Low Low None

Impact

Guest sessions are shared between customers when HTTP cache is enabled. Setups with Varnish are not affected by this issue

Patches

We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

Security Plugin

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Disable HTTP Cache

Disabling HTTP Cache is also a valid workaround

Affected versions

6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.16.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.0

+ 39 more Show less

6.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.2.06.4.2.16.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.16.4.6.06.4.6.16.4.7.06.4.8.06.4.8.1v6.0.0+ea2v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3

Fixed in

6.4.8.2

References

https://github.com/shopware/platform/security/advisories/GHSA-jp6h-mxhx-pgqh
https://nvd.nist.gov/vuln/detail/CVE-2022-24745
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022?_ga=2.159980029.1931762803.1646933116-1088482757.1646933116
https://github.com/shopware/platform

Updated Nov 08, 2023 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 7
patch 183
pre 22

213 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More