UpHeron
All vulnerabilities

Servers and applications

GHSA-v78h-66q4-h9px

Host header injection in the shop password reset e-mail link when the channel has no hostname

Severity
High 8.1
Published
22 Oct 2026
Last changed
22 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.14.21, 2.1.17, 2.2.12, 2.3.2
Sources
Project advisories (GitHub)

Affected software

SoftwareAffected versions
SyliusServers and applications · github:sylius/sylius
  • From 1.9.0 before 1.14.21
  • From 2.0.0 up to 2.0.18
  • From 2.1.0 before 2.1.17
  • From 2.2.0 before 2.2.12
  • From 2.3.0 before 2.3.2

References