{"id":"CVE-2026-23498","published":"2026-01-14T18:31:19Z","modified":"2026-01-14T21:15:57Z","title":"Shopware Improper Control of Generation of Code in Twig rendered views","vendor":"shopware","product":"shopware","tier":"tail","description":{"text":"Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00442,"percentile":0.38418,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475","tags":["x_refsource_MISC"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":7.68},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.04}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-04-11","earliestUrl":"https://github.com/lukasz-rybak/CVE-2026-23498","repos":[{"name":"lukasz-rybak/CVE-2026-23498","url":"https://github.com/lukasz-rybak/CVE-2026-23498","stars":0,"created":"2026-04-11"}]},"first":{"date":"2026-04-11","source":"PoC-in-GitHub","url":"https://github.com/lukasz-rybak/CVE-2026-23498"},"provenance":"source"},"vendorSlug":"shopware","affectedVersions":[{"vendor":"shopware","product":"shopware","versions":[">= 6.7.0.0, < 6.7.6.1"]}],"affected":[{"ecosystem":"Packagist","package":"shopware/shopware","vulnerableRanges":[">=6.7.0.0, <6.7.6.1"],"patched":["6.7.6.1"],"from":["GHSA-7cw6-7h3h-v8pf"],"provenance":"source"},{"ecosystem":"Packagist","package":"shopware/core","vulnerableRanges":[">=6.7.0.0, <6.7.6.1"],"patched":["6.7.6.1"],"from":["GHSA-7cw6-7h3h-v8pf"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-2421","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-shopware-platform-cve-2023-22731","parents":[{"from":"CVE-2023-2017","to":"CVE-2026-23498","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override.","from":"CVE.org","in":"CVE-2026-23498"},{"kind":"osv-related","provenance":"source","id":"GHSA-7cw6-7h3h-v8pf","via":"reference","url":"https://github.com/advisories/GHSA-7v2v-9rm4-7m8f"}]}],"packageHistory":[{"cve":"CVE-2023-34098","published":"2023-06-27","fixed":"5.7.18","kev":false},{"cve":"CVE-2023-34099","published":"2023-06-27","fixed":"5.7.18","kev":false},{"cve":"CVE-2025-67648","published":"2025-12-10","fixed":"6.7.5.1","kev":false,"link":{"from":"CVE-2025-67648","to":"CVE-2026-23498","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:shopware/shopware","fromFixed":"6.7.5.1","toFixed":"6.7.6.1","daysApart":35}]}},{"cve":"CVE-2026-23498","published":"2026-01-14","fixed":"6.7.6.1","kev":false}],"package":"Packagist:shopware/shopware"}}