CVE-2024-42356

Summary

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Severity

high

EPSS

0.6% (p46)

Also known as

GHSA-35jp-8cgg-p4wj#shopware/core, GHSA-35jp-8cgg-p4wj#shopware/platform

Published

2024-08-08

References

• https://github.com/shopware/shopware/security/advisories/GHSA-35jp-8cgg-p4wj
• https://nvd.nist.gov/vuln/detail/CVE-2024-42356
• https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038

Related advisories

• CVE-2026-31889 — high · Packagist/shopware/core
• CVE-2026-31887 — high · Packagist/shopware/core
• CVE-2026-23498 — high · Packagist/shopware/core
• GHSA-9v82-vcjx-m76j#shopware/core — high · Packagist/shopware/core
• CVE-2025-27892 — high · Packagist/shopware/core
• CVE-2025-30151 — high · Packagist/shopware/core
• CVE-2024-42355 — high · Packagist/shopware/core
• CVE-2026-48013 — medium · Packagist/shopware/core

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity