Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-23498 — CVE-2026-23498 - Shopware Has Improper Control of Generation of Code in Twig rendered views | Kitploit
Tools/GitHubGitHub/lukasz-rybak/cve-2026-23498
Vulnerability AnalysisCode AnalysisWeb Application ExploitationPapers & ResearchLearning & Education
GitHublukasz-rybak/cve-2026-23498

CVE-2026-23498

CVE-2026-23498 - Shopware Has Improper Control of Generation of Code in Twig rendered views

View Repository
15 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-23498: Shopware Has Improper Control of Generation of Code in Twig rendered views

Overview

FieldDetails
CVE IDCVE-2026-23498
SeverityHIGH
AdvisoryView Advisory
Discovered byLukasz Rybak

Affected Products

  • shopware/shopware (versions: >= 6.7.0.0, < 6.7.6.1)
  • shopware/core (versions: >= 6.7.0.0, < 6.7.6.1)

CWE Classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Details

Impact

We fixed with CVE-2023-2017 Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override

Patches

Patched in 6.7.6.1

Workarounds

Install the security plugin

References

(https://github.com/advisories/GHSA-7v2v-9rm4-7m8f)

References

  • https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf
  • https://github.com/advisories/GHSA-7v2v-9rm4-7m8f
  • https://nvd.nist.gov/vuln/detail/CVE-2026-23498
  • https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475
  • https://github.com/advisories/GHSA-7cw6-7h3h-v8pf

Disclaimer

This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.

Download Tool