CVE-2026-23498
Fixed upstream EPSS <1%CVSS 7.2
Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.
Products: shopware
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | shopware/core | 6.7.6.1 |
| Packagist | shopware/shopware | 6.7.6.1 |