CVE-2024-42356

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin.

• CWE-1336
• CWE-94

• https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038Patch
• https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442fPatch
• https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0acPatch
• https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2ePatch
• https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wjVendor Advisory

Published

Aug 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42350Biscuit is an authorization token with decentralized verific…3
• CVE-2024-42351Galaxy is a free, open-source system for analyzing data, aut…9.1
• CVE-2024-42352Nuxt is a free and open-source framework to create full-stac…7.5
• CVE-2024-42353WebOb provides objects for HTTP requests and responses. When…6.1
• CVE-2024-42354Shopware is an open commerce platform. The store-API works w…5.9
• CVE-2024-42355Shopware, an open ecommerce platform, has a new Twig Tag `sw…9.8
• CVE-2024-42357Shopware is an open commerce platform. Prior to versions 6.6…9.8
• CVE-2024-42358PDFio is a simple C library for reading and writing PDF file…5.5
• CVE-2024-4236A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-42360SequenceServer lets you rapidly set up a BLAST+ server with …9.8
• CVE-2024-42361Hertzbeat is an open source, real-time monitoring system. He…9.8
• CVE-2024-42362Hertzbeat is an open source, real-time monitoring system. He…8.8