HighGHSA-vrf2-xghr-j52vCVE-2021-32717GHSA-6gr8-c3m5-mvrg

Private files publicly accessible with Cloud Storage providers

Published 28 Jun 2021 · Updated 10 Sept 2026

Affected packages

shopware/platformComposer
Affected
<6.4.1.1
Fixed in
6.4.1.1
Update to the fixed version for your release line, for example:composer require shopware/platform:^6.4.1.1
shopware/coreComposer
Affected
<6.4.1.1
Fixed in
6.4.1.1
Update to the fixed version for your release line, for example:composer require shopware/core:^6.4.1.1

Details

Impact

Private files publicly accessible with Cloud Storage providers when the hashed URL is known

Patches

We recommend first changing your configuration to set the correct visibility according to the documentation. The visibility must be at the same level as type.

When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command ./bin/console s3:set-visibility to correct your cloud file visibilities

Is GHSA-vrf2-xghr-j52v in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected shopware/platform, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.