UpHeron
All vulnerabilities

Servers and applications

CVE-2023-2017

Improper Control of Generation of Code in Twig rendered views

Severity
High 8.8
Published
17 Apr 2023
Last changed
24 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.4.20.1
Also known as
GHSA-7v2v-9rm4-7m8f
Sources
NVD, Project advisories (GitHub)

Description

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus…

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • From 6.1.0 up to 6.4.20.0
  • Version 6.5.0.0-rc1
  • Version 6.5.0.0-rc2
  • Version 6.5.0.0-rc3
ShopwareServers and applications · github:shopware/shopware
  • Every version before 6.4.20.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-2017
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-2017
  • GitHub Advisory Database https://github.com/advisories/GHSA-7v2v-9rm4-7m8f
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-7v2v-9rm4-7m8f