CVE-2026-23498

Katalog CVE

CVSS 7.2 · High EPSS 0,44%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada shopware. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

Rincian

Terbit di NVD

14 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475 patch
• https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf advisory pihak ketiga