{"id":"CVE-2024-42356","aliases":["GHSA-35jp-8cgg-p4wj"],"url":"https://o3.security/vulnerability/CVE-2024-42356","summary":"Shopware vulnerable to Server Side Template Injection in Twig using Context functions","details":"### Impact\nThe `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. \n\nExample call from PHP:\n\n```php\n$context->scope(Context::SYSTEM_SCOPE, static function (Context $context) use ($mediaService, $media, &$fileBlob): void {\n    $fileBlob = $mediaService->loadFile($media->getId(), $context);\n});\n```\n\nThis function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method.\n\nIt's not possible as customer to provide any Twig code, the attacker would require access to Administration to exploit it using Mail templates or using App Scripts.\n\n### Patches\nUpdate to Shopware 6.6.5.1 or 6.5.8.13\n\n### Workarounds\nFor older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n","published":"2024-08-08T14:52:53.604Z","modified":"2026-08-12T03:51:15.985002804Z","cvss":{"score":8.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"},"epss":{"score":0.00648,"percentile":0.49435,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.5.8.13"},{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.5.8.13"},{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.6.5.1"},{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.6.5.1"}],"fix":{"url":"https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038","label":"shopware/core@04183e0"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42356.json"},{"type":"ADVISORY","url":"https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42356"},{"type":"FIX","url":"https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038"},{"type":"FIX","url":"https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f"},{"type":"FIX","url":"https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac"},{"type":"FIX","url":"https://github.com/shopware/shopware/commit/e43423bcc93c618c3036f94c12aa29514da8cf2e"},{"type":"PACKAGE","url":"https://github.com/shopware/shopware"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:15.985002804Z"}}