CVE-2025-67648

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58	Patch
https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:shopware:shopware::::::::
	cpe:2.3:a:shopware:shopware::::::::

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Shopware es una plataforma de comercio abierta. Las versiones 6.4.6.0 a 6.6.10.9 y 6.7.0.0 a 6.7.5.0 tienen una vulnerabilidad de XSS Reflejado en AuthController.PHP. Un parámetro de solicitud de la URL de la página de inicio de sesión se renderiza directamente dentro de la plantilla Twig de la página de inicio de sesión de Storefront sin procesamiento adicional o validación de entrada. Esto permite la inyección directa de código en la plantilla a través del parámetro de URL, waitTime, que carece de validación de entrada adecuada. Este problema está solucionado en las versiones 6.6.10.10 y 6.7.5.1.

Information

Published : 2025-12-11 00:16

Updated : 2026-10-14 20:10

NVD link : CVE-2025-67648

Mitre link : CVE-2025-67648

CVE.ORG link : CVE-2025-67648

JSON object : View

Products Affected

shopware

shopware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-67648", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67648", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T18:59:56.527334Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "shopware", "product": "shopware", "versions": [{"status": "affected", "version": ">= 6.4.6.0, < 6.6.10.10"}, {"status": "affected", "version": ">= 6.7.0.0, < 6.7.5.1"}]}]}], "published": "2025-12-11T00:16:23.557", "references": [{"url": "https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1."}, {"lang": "es", "value": "Shopware es una plataforma de comercio abierta. Las versiones 6.4.6.0 a 6.6.10.9 y 6.7.0.0 a 6.7.5.0 tienen una vulnerabilidad de XSS Reflejado en AuthController.PHP. Un par\u00e1metro de solicitud de la URL de la p\u00e1gina de inicio de sesi\u00f3n se renderiza directamente dentro de la plantilla Twig de la p\u00e1gina de inicio de sesi\u00f3n de Storefront sin procesamiento adicional o validaci\u00f3n de entrada. Esto permite la inyecci\u00f3n directa de c\u00f3digo en la plantilla a trav\u00e9s del par\u00e1metro de URL, waitTime, que carece de validaci\u00f3n de entrada adecuada. Este problema est\u00e1 solucionado en las versiones 6.6.10.10 y 6.7.5.1."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F912C545-B472-43DB-8CAC-E9A5791D6E8B", "versionEndExcluding": "6.6.10.10", "versionStartIncluding": "6.4.6.0"}, {"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DBFD7B3-151A-46E7-81CE-30971D05FD21", "versionEndExcluding": "6.7.5.1", "versionStartIncluding": "6.7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}