PT-2026-2949

CVE-2026-23498

Published

2026-01-14

Updated

2026-01-28

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shopware versions 6.7.0.0 through 6.7.6.0

Description The software contains a flaw due to a regression of a previous fix, allowing the execution of unchecked PHP Closures within the map() override function. This could potentially lead to remote code execution. The issue stems from an insufficient allow list check for PHP Closures used in the map() function.

Recommendations Update to version 6.7.6.1 or later. Install the security plugin.

Exploitability

Exploit

Fix

Impacts

Researchers

Lukasz-Rybak

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers