7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23498

CVE-2026-23498: Shopware Improper Control of Generation of Code in Twig rendered views

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23498

CVE-2026-23498:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
shopware/shopware	composer	>= 6.7.0.0, < 6.7.6.1	6.7.6.1
shopware/core	composer	>= 6.7.0.0, < 6.7.6.1	6.7.6.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the map function of the Shopware\Core\Framework\Adapter\Twig\SecurityExtension class. The vulnerability description states that a regression allowed a crafted array or PHP Closure to bypass an allow list for the map() override. By analyzing the patch between the vulnerable version 6.7.6.0 and the patched version 6.7.6.1, I identified the exact commit that fixes this issue. The commit 3966b05590e29432b8485ba47b4fcd14dd0b8475 modifies the src/Core/Framework/Adapter/Twig/SecurityExtension.php file. The change within the map function adds a code block to handle cases where the $function argument is an array. It converts the array callable into a string, which is then subjected to the security check against the allowedPHPFunctions list. Before this change, an array callable would bypass this check, leading to a code injection vulnerability. Therefore, the Shopware\Core\Framework\Adapter\Twig\SecurityExtension::map function is the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.