Is shopware/core 6.2 vulnerable?
Composer · 4 releases from 6.2.0 to 6.2.3 · latest shopware/core is 6.7.15.1 · checked 1 Nov 2026
Yes: 59 known advisories
Yes. shopware/core 6.2.3, the last 6.2 release, is affected by 59 known security advisories (5 critical, 13 high, 27 medium, 14 low), including CVE-2024-22406, CVE-2023-22731, CVE-2026-31889. 1 more affects earlier 6.2.x releases. Upgrade to 6.6.10.18 or later to fix all of them.
composer require shopware/core:^6.6.10.18Advisories affecting shopware/core 6.2.3
Shopware: Stored XSS via SVG file upload — no SVG sanitization
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Admin Account Takeover via User Recovery Hash Exposure
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware vulnerable to a potential take over of app credentials
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware has user enumeration via distinct error codes on Store API login endpoint
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware 6's password recovery link does not expire after email change
- Affected
- <6.6.10.9 · >=6.7.0.0 <6.7.4.1
- Fixed in
- 6.6.10.9, 6.7.4.1
Shopware Customer Orders can be canceled, even if refunds are disabled
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware exposes sensitive user information via CSV export mapping
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to path traversal via Plugin upload
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware default newsletter opt-in settings allow for mass sign-up abuse
- Affected
- >=6.6.0.0-rc1 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17
- Fixed in
- 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2
Shopware Broken ACL on Document retrieval to access other customers documents
- Affected
- >=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17
- Fixed in
- 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2
Shopware Vulnerable to Blind SQL-injection in DAL aggregations
- Affected
- >=6.7.0.0-rc1 <6.7.0.0-rc2 · >=6.6.0.0 <6.6.10.3 · <6.5.8.18
- Fixed in
- 6.5.8.18, 6.6.10.3, 6.7.0.0-rc2
Shopware allows Denial Of Service via password length
- Affected
- >=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17
- Fixed in
- 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2
Shopware 6 allows attackers to check for registered accounts through the store-api
- Affected
- >=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.18
- Fixed in
- 6.5.8.18, 6.6.10.3, 6.7.0.0-rc2
Shopware vulnerable to blind SQL-injection in DAL aggregations
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Broken Access Control order API in Shopware
- Affected
- <6.5.7.4
- Fixed in
- 6.5.7.4
Blind SQL injection in shopware
- Affected
- <6.5.7.4
- Fixed in
- 6.5.7.4
Shopware Has Improper Control of Generation of Code in Twig rendered views
- Affected
- <6.4.20.1
- Fixed in
- 6.4.20.1
Shopware has Improper Input Validation issue in newsletter subscription
- Affected
- <6.4.18.1
- Fixed in
- 6.4.18.1
Shopware has Insufficient Session Expiration in Administration
- Affected
- <6.4.18.1
- Fixed in
- 6.4.18.1
Shopware's log module vulnerable to Improper Output Neutralization
- Affected
- <6.4.18.1
- Fixed in
- 6.4.18.1
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views
- Affected
- <6.4.18.1
- Fixed in
- 6.4.18.1
Shopware vulnerable to Improper Input Validation of Clearance sale in cart
- Affected
- <6.4.18.1
- Fixed in
- 6.4.18.1
Improper Access Control in Shopware
- Affected
- <6.4.10.1
- Fixed in
- 6.4.10.1
Server-Side Request Forgery (SSRF) in Shopware
- Affected
- <6.4.10.1
- Fixed in
- 6.4.10.1
Incorrect Authentication in shopware
- Affected
- <6.4.8.2
- Fixed in
- 6.4.8.2
HTTP caching is marking private HTTP headers as public in Shopware
- Affected
- <6.4.8.2
- Fixed in
- 6.4.8.2
HTML injection possibility in voucher code form in Shopware
- Affected
- <6.4.8.1
- Fixed in
- 6.4.8.1
Shopware user session is not logged out if the password is reset via password recovery
- Affected
- <6.4.8.1
- Fixed in
- 6.4.8.1
Webcache Poisoning in shopware/platform and shopware/core
- Affected
- <6.4.6.1
- Fixed in
- 6.4.6.1
Insecure direct object reference of log files of the Import/Export feature
- Affected
- <6.4.3.1
- Fixed in
- 6.4.3.1
Command injection in mail agent settings
- Affected
- <6.4.3.1
- Fixed in
- 6.4.3.1
Manipulation of product reviews via API
- Affected
- <6.4.3.1
- Fixed in
- 6.4.3.1
Cross-Site Scripting via SVG media files
- Affected
- <6.4.3.1
- Fixed in
- 6.4.3.1
Authenticated server-side request forgery in file upload via URL.
- Affected
- <6.4.3.1
- Fixed in
- 6.4.3.1
non-admin users can create integration role with administrator role
- Affected
- <6.4.1.1
- Fixed in
- 6.4.1.1
Internal hidden fields are visible on to many associations in admin api
- Affected
- <6.4.1.1
- Fixed in
- 6.4.1.1
Private files publicly accessible with Cloud Storage providers
- Affected
- <6.4.1.1
- Fixed in
- 6.4.1.1
Creation of order credits was not validated by acl in admin orders
- Affected
- <6.4.1.1
- Fixed in
- 6.4.1.1
Canceling of orders not related to the logged-in user
- Affected
- <6.4.1.1
- Fixed in
- 6.4.1.1
After order payment process manipulation in shopware/platform and shopware/core
- Affected
- <6.3.5.3
- Fixed in
- 6.3.5.3
Leak of information via Store-API aggregations in shopware/platform and shopware/core
- Affected
- <6.3.5.3
- Fixed in
- 6.3.5.3
Authenticated Server Side Request Forgery
- Affected
- <6.3.4.1
- Fixed in
- 6.3.4.1
Information exposure via query strings in URL
- Affected
- <6.3.4.1
- Fixed in
- 6.3.4.1
Authenticated Privilege Escalation
- Affected
- <6.3.4.1
- Fixed in
- 6.3.4.1
Denial of Service via Cache Flooding
- Affected
- <6.3.2.1
- Fixed in
- 6.3.2.1
Authenticated XML External Entity Processing
- Affected
- <6.3.2.1
- Fixed in
- 6.3.2.1
Non-persistent XSS in the Storefront in Shopware
- Affected
- <6.3.1.1
- Fixed in
- 6.3.1.1
RCE in Third Party Library in Shopware
- Affected
- <6.3.1.1
- Fixed in
- 6.3.1.1
Fixed within 6.2.x, affecting earlier releases
Shopware database password is leaked to an unauthenticated users
- Affected
- >=6.0.0 <6.2.3
- Fixed in
- 6.2.3
Which of your client projects are still on shopware/core 6.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact shopware/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other shopware/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.