Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the handling of the 'name' field within nested aggregation objects in Shopware's DAL (Data Abstraction Layer). The provided commit 0372c310349f9ad8e3401af69fc260378861b278 patches this vulnerability.
src/Core/Framework/DataAbstractionLayer/Dbal/EntityAggregator.php.fetchAggregation is responsible for processing these aggregations. Before the patch, it had a direct, non-recursive check for invalid characters in the aggregation name: if (str_contains($aggregation->getName(), '?') || str_contains($aggregation->getName(), ':')). This check was insufficient for nested aggregations as stated in the vulnerability description.validateAggregation(Aggregation $aggregation). This method performs the same check on getName() but crucially, if the aggregation is a BucketAggregation and contains a nested aggregation ($aggregation->getAggregation()), it calls validateAggregation recursively on the nested aggregation. The fetchAggregation method was modified to call $this->validateAggregation($aggregation); at its beginning, replacing its previous direct validation.fetchAggregation is the public-facing (within the class context, though it's private, it's the one that initiates the aggregation processing logic) method that handles the aggregation criteria and would have processed the malicious input (the aggregation name) prior to the fix, it is identified as the vulnerable function. The lack of recursive validation for nested aggregation names within fetchAggregation (before the patch) is the core of the vulnerability.| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/core | composer | = 6.7.0.0-rc1 | 6.7.0.0-rc2 |
| shopware/platform | composer | = 6.7.0.0-rc1 | 6.7.0.0-rc2 |
| shopware/core | composer | >= 6.6.0.0, <= 6.6.10.2 | 6.6.10.3 |
| shopware/platform | composer | >= 6.6.0.0, <= 6.6.10.2 | 6.6.10.3 |
| shopware/core | composer | < 6.5.8.18 | 6.5.8.18 |
| shopware/platform | composer | < 6.5.8.18 | 6.5.8.18 |