CVE-2024-42355: shopware Code Injection — Fix

Description

Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.

Is your site exposed to CVE-2024-42355?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness Type (CWE)

CWE-1336 CWE-1336

CWE-94 CWE-94

Affected Products

Vendor	Product	Versions
shopware	shopware	< 6.5.8.13
shopware	shopware	6.6.0.0 — 6.6.5.1

References

Advisories & Patches

https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f https://github.com/shopware/core/commit/d35ee2eda5c995faeb08b3dad127eab65c64e2a2 https://github.com/shopware/shopware/commit/445c6763cc093fbd651e0efaa4150deae4ae60da https://github.com/shopware/shopware/commit/8504ba7e56e53add6a1d5b9d45015e3d899cd0ac https://github.com/shopware/shopware/security/advisories/GHSA-27wp-jvhw-v4xp

Frequently Asked Questions

What is CVE-2024-42355? +

Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. It has a CVSS v3.1 base score of 8.3 (HIGH).

How severe is CVE-2024-42355? +

CVE-2024-42355 has a CVSS v3.1 score of 8.3 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-42355? +

CVE-2024-42355 affects products from shopware, specifically: shopware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-42355? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-26789

An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to …

CVE-2024-58303

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email …

CVE-2026-44181

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions …

CVE-2026-9177

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version …

CVE-2024-58293

Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input …

CVE-2026-55794

Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with …

CVE-2024-42355