{"id":"GHSA-7cw6-7h3h-v8pf","aliases":["CVE-2026-23498"],"title":"Shopware Has Improper Control of Generation of Code in Twig rendered views","description":"### Impact\nWe fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override\n\n### Patches\nPatched in 6.7.6.1\n\n### Workarounds\nInstall the security plugin","severity":"high","score":7.2,"published":"2026-01-14T16:54:27.000Z","modified":"2026-02-03T02:56:25.126Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"shopware/shopware","ranges":[{"events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.6.1"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["6.7.6.1"]},{"ecosystem":"Packagist","name":"shopware/core","ranges":[{"events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.6.1"}],"type":"ECOSYSTEM"}],"versions":["v6.7.0.0","v6.7.0.1","v6.7.1.0","v6.7.1.1","v6.7.1.2","v6.7.2.0","v6.7.2.1","v6.7.2.2","v6.7.3.0","v6.7.3.1","v6.7.4.0","v6.7.4.1","v6.7.4.2","v6.7.5.0","v6.7.5.1","v6.7.6.0"],"fixed":["6.7.6.1"]}],"references":["https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf","https://nvd.nist.gov/vuln/detail/CVE-2026-23498","https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475","https://github.com/advisories/GHSA-7v2v-9rm4-7m8f","https://github.com/shopware/shopware"],"sources":[{"name":"OSV","id":"GHSA-7cw6-7h3h-v8pf","modified":"2026-02-03T02:56:25.126713Z","url":"https://osv.dev/vulnerability/GHSA-7cw6-7h3h-v8pf"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2}]}