Is shopware/core 6.5 vulnerable?
Composer · 9 releases from 6.5.0 to 6.5.8 · latest shopware/core is 6.7.16.0 · checked 2 Nov 2026
Yes: 16 known advisories
Yes. shopware/core 6.5.8, the last 6.5 release, is affected by 16 known security advisories (2 high, 11 medium, 3 low), including CVE-2026-31889, CVE-2026-31887, CVE-2026-48015. 12 more affect earlier 6.5.x releases. Upgrade to 6.6.10.18 or later to fix all of them.
composer require shopware/core:^6.6.10.18Advisories affecting shopware/core 6.5.8
Shopware: Stored XSS via SVG file upload — no SVG sanitization
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Admin Account Takeover via User Recovery Hash Exposure
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware vulnerable to a potential take over of app credentials
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware has user enumeration via distinct error codes on Store API login endpoint
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware 6's password recovery link does not expire after email change
- Affected
- <6.6.10.9 · >=6.7.0.0 <6.7.4.1
- Fixed in
- 6.6.10.9, 6.7.4.1
Shopware Customer Orders can be canceled, even if refunds are disabled
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware exposes sensitive user information via CSV export mapping
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to path traversal via Plugin upload
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Fixed within 6.5.x, affecting earlier releases
Shopware default newsletter opt-in settings allow for mass sign-up abuse
- Affected
- >=6.6.0.0-rc1 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17
- Fixed in
- 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2
Shopware Broken ACL on Document retrieval to access other customers documents
- Affected
- >=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17
- Fixed in
- 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2
Shopware Vulnerable to Blind SQL-injection in DAL aggregations
- Affected
- >=6.7.0.0-rc1 <6.7.0.0-rc2 · >=6.6.0.0 <6.6.10.3 · <6.5.8.18
- Fixed in
- 6.5.8.18, 6.6.10.3, 6.7.0.0-rc2
Shopware allows Denial Of Service via password length
- Affected
- >=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.17
- Fixed in
- 6.5.8.17, 6.6.10.3, 6.7.0.0-rc2
Shopware 6 allows attackers to check for registered accounts through the store-api
- Affected
- >=6.6.0.0 <6.6.10.3 · >=6.7.0.0-rc1 <6.7.0.0-rc2 · <6.5.8.18
- Fixed in
- 6.5.8.18, 6.6.10.3, 6.7.0.0-rc2
Shopware vulnerable to blind SQL-injection in DAL aggregations
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
- Affected
- <6.5.8.13 · >=6.6.0.0 <6.6.5.1
- Fixed in
- 6.5.8.13, 6.6.5.1
Shopware Improper Session Handling in store-api account logout
- Affected
- >=6.3.5.0 <6.5.8.8 · >=6.6.0.0-rc1 <6.6.1.0
- Fixed in
- 6.5.8.8, 6.6.1.0
Broken Access Control order API in Shopware
- Affected
- <6.5.7.4
- Fixed in
- 6.5.7.4
Blind SQL injection in shopware
- Affected
- <6.5.7.4
- Fixed in
- 6.5.7.4
Which of your client projects are still on shopware/core 6.5?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact shopware/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other shopware/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.