CVE-2023-22731

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished. Users are advised to upgrade. Users of major versions 6.1, 6.2, and 6.3 may also receive this fix via a plugin.

• CWE-94

• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesPatch, Vendor Advisory
• https://github.com/shopware/platform/commit/89d1ea154689cb6202e0d3a0ceeae0febb0c09e1Patch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-93cw-f5jj-x85wThird Party Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesPatch, Vendor Advisory
• https://github.com/shopware/platform/commit/89d1ea154689cb6202e0d3a0ceeae0febb0c09e1Patch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-93cw-f5jj-x85wThird Party Advisory

Published

Jan 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22726act is a project which allows for local running of github ac…8.8
• CVE-2023-22727CakePHP is a development framework for PHP web apps. In affe…9.8
• CVE-2023-22728Silverstripe Framework is the Model-View-Controller framewor…4.3
• CVE-2023-22729Silverstripe Framework is the Model-View-Controller framewor…6.1
• CVE-2023-2273Rapid7 Insight Agent token handler versions 3.2.6 and below,…7.5
• CVE-2023-22730Shopware is an open source commerce platform based on Symfon…7.5
• CVE-2023-22732Shopware is an open source commerce platform based on Symfon…9.8
• CVE-2023-22733Shopware is an open source commerce platform based on Symfon…6.5
• CVE-2023-22734Shopware is an open source commerce platform based on Symfon…7.5
• CVE-2023-22735Zulip is an open-source team collaboration tool. In versions…4.6
• CVE-2023-22736Argo CD is a declarative, GitOps continuous delivery tool fo…8.5
• CVE-2023-22737wire-server provides back end services for Wire, a team comm…6.5