Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-q1tz-feg4-sfa1
Vulnerability ID VCID-q1tz-feg4-sfa1
Aliases CVE-2024-42356
GHSA-35jp-8cgg-p4wj
Summary Shopware vulnerable to Server Side Template Injection in Twig using Context functions ### Impact The `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: ```php $context->scope(Context::SYSTEM_SCOPE, static function (Context $context) use ($mediaService, $media, &$fileBlob): void { $fileBlob = $mediaService->loadFile($media->getId(), $context); }); ``` This function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. ### Patches Update to Shopware 6.6.5.1 or 6.5.8.13 ### Workarounds For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00429 https://api.first.org/data/v1/epss?cve=CVE-2024-42356
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-35jp-8cgg-p4wj
cvssv3.1 8.3 https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
cvssv4 8.7 https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
generic_textual HIGH https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
ssvc Track* https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
cvssv3.1 8.3 https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
cvssv4 8.7 https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
generic_textual HIGH https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
ssvc Track* https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
cvssv3.1 8.3 https://github.com/shopware/shopware
cvssv4 8.7 https://github.com/shopware/shopware
generic_textual HIGH https://github.com/shopware/shopware
cvssv3.1 8.3 https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
cvssv4 8.7 https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
generic_textual HIGH https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
ssvc Track* https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
cvssv3.1 8.3 https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
cvssv4 8.7 https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
generic_textual HIGH https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
ssvc Track* https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
cvssv3.1 8.3 https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
cvssv3.1_qr HIGH https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
cvssv4 8.7 https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
generic_textual HIGH https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
ssvc Track* https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
cvssv3.1 8.3 https://nvd.nist.gov/vuln/detail/CVE-2024-42356
cvssv4 8.7 https://nvd.nist.gov/vuln/detail/CVE-2024-42356
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-42356
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-42356
https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
https://github.com/shopware/shopware
https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
https://nvd.nist.gov/vuln/detail/CVE-2024-42356
GHSA-35jp-8cgg-p4wj https://github.com/advisories/GHSA-35jp-8cgg-p4wj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Found at https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-09T15:51:49Z/ Found at https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Found at https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-09T15:51:49Z/ Found at https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Found at https://github.com/shopware/shopware
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Found at https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-09T15:51:49Z/ Found at https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Found at https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-09T15:51:49Z/ Found at https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Found at https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-09T15:51:49Z/ Found at https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-42356
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-42356
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.62782
EPSS Score 0.00429
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:44:15.371674+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-35jp-8cgg-p4wj/GHSA-35jp-8cgg-p4wj.json 38.6.0