Is shopware/core 6.7 vulnerable?
Composer · 16 releases from 6.7.0 to 6.7.15 · latest shopware/core is 6.7.15.1 · checked 1 Nov 2026
No known advisories in the last release
shopware/core 6.7.15, the last 6.7 release, has no known advisories. 20 advisories affect earlier 6.7.x releases, so update to 6.7.15.
composer require shopware/core:^6.7.15Fixed within 6.7.x, affecting earlier releases
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
- Affected
- >=6.7.0.0 <6.7.10.1
- Fixed in
- 6.7.10.1
Shopware: Stored XSS via SVG file upload — no SVG sanitization
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware SSO referer trust leading to an arbitrary redirect target
- Affected
- >=6.7.3.0 <6.7.10.1
- Fixed in
- 6.7.10.1
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Admin Account Takeover via User Recovery Hash Exposure
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
- Affected
- >=6.7.0.0 <6.7.10.1 · <6.6.10.18
- Fixed in
- 6.6.10.18, 6.7.10.1
Shopware vulnerable to a potential take over of app credentials
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware has user enumeration via distinct error codes on Store API login endpoint
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
- Affected
- >=6.7.0.0 <6.7.8.1 · <6.6.10.15
- Fixed in
- 6.6.10.15, 6.7.8.1
Shopware Has Improper Control of Generation of Code in Twig rendered views
- Affected
- >=6.7.0.0 <6.7.6.1
- Fixed in
- 6.7.6.1
Shopware 6's password recovery link does not expire after email change
- Affected
- <6.6.10.9 · >=6.7.0.0 <6.7.4.1
- Fixed in
- 6.6.10.9, 6.7.4.1
Shopware Customer Orders can be canceled, even if refunds are disabled
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware exposes sensitive user information via CSV export mapping
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to path traversal via Plugin upload
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually
- Affected
- >=6.7.0.0 <6.7.3.1 · <6.6.10.7
- Fixed in
- 6.6.10.7, 6.7.3.1
Shopware: Reflective Cross Site-Scripting (XSS) in CMS components
- Affected
- >=6.7.0.0 <6.7.2.1
- Fixed in
- 6.7.2.1
Which of your client projects are still on shopware/core 6.7?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact shopware/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other shopware/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.