CVE-2024-42356: shopware Code Injection — Fix

Description

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin.

Is your site exposed to CVE-2024-42356?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness Type (CWE)

CWE-1336 CWE-1336

CWE-94 CWE-94

Affected Products

Vendor	Product	Versions
shopware	shopware	< 6.5.8.13
shopware	shopware	6.6.0.0 — 6.6.5.1

References

Advisories & Patches

https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038 https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj

Frequently Asked Questions

What is CVE-2024-42356? +

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. It has a CVSS v3.1 base score of 8.3 (HIGH).

How severe is CVE-2024-42356? +

CVE-2024-42356 has a CVSS v3.1 score of 8.3 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-42356? +

CVE-2024-42356 affects products from shopware, specifically: shopware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-42356? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" …

CVE-2026-46636

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls …

CVE-2026-41065

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to …

CVE-2026-47727

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize …

CVE-2025-34300

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web …

CVE-2026-62682

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick …

CVE-2024-42356