Dashboard / CVE-2023-2017

CVE-2023-2017

HIGH
MEDIUM Priority: 0.18 BB Relevance: 68/100
Published: 2023-04-17 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.

Weakness Classification (3)

Affected Software (4)

VendorProductVersion
shopware shopware 6.1.0 – 6.4.20.0
shopware shopware 6.5.0.0
shopware shopware 6.5.0.0
shopware shopware 6.5.0.0

References & Advisories (3)

https://starlabs.sg/advisories/23/23-2017/
Exploit Mitigation Third Party Advisory

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

2.07%
Raw Score 0.020660
Percentile 81.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.02066
2026-10-28
0.02066

Intelligence Sources

nvd ref →

External Links