CVE-2025-27892: Shopware Core and Platform SQL Injection Vulnerability in Aggregations
Summary
CVE-2025-27892: Shopware Vulnerable to Blind SQL-injection in DAL aggregations. Affects shopware/core across 3 version ranges.
< 6.5.8.18
>= 6.6.0.0, < 6.6.10.3
>= 6.7.0.0-rc1, < 6.7.0.0-rc2
Fixed in 6.5.8.18, 6.6.10.3 or 6.7.0.0-rc2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Shopware is an open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and various integrations to enhance the shopping experience. The platform's API includes a search functionality that allows users to query their Shopware instance. However, this functionality has been found to be vulnerable to SQL injection attacks, specifically in the aggregations feature.
Vulnerability Detail
The vulnerability arises from the search functionality in the Shopware API, which allows users to search through stored information. The 'name' field within the 'aggregations' object is susceptible to SQL injection due to improper handling of user input. Attackers can exploit this vulnerability by injecting malicious SQL code, potentially leading to unauthorized access to the database, data leakage, or data manipulation. This vulnerability has been classified with a CVSS score of 7.3, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.5.8.186.5.8.18composer require shopware/core:6.5.8.18 -
>= 6.6.0.0, < 6.6.10.36.6.10.3composer require shopware/core:6.6.10.3 -
>= 6.7.0.0-rc1, < 6.7.0.0-rc26.7.0.0-rc2composer require shopware/core:6.7.0.0-rc2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users on older versions of Shopware 6.4, a plugin is available that implements corresponding security measures. It is recommended to apply this plugin until an upgrade to the latest version can be performed.
Conclusion
The Shopware vulnerability CVE-2025-27892 poses a significant risk due to its potential for SQL injection attacks. Users are strongly advised to update to the latest patched versions to mitigate this risk. For those unable to update immediately, utilizing the available plugin can provide temporary protection.
See every vulnerability recorded for shopware/core →
FAQ
The vulnerability is a blind SQL injection that affects the aggregations feature in the Shopware API.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
Exploitation of this vulnerability can lead to unauthorized database access, data leakage, or data manipulation.
Yes, a plugin is available for older versions of Shopware 6.4 that implements security measures against this vulnerability.
If immediate updating is not possible, apply the available plugin for older versions as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
