Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. shopware/core
  4. ›
  5. GHSA-27c9-vp3w-6ww8

GHSA-27c9-vp3w-6ww8: Shopware exposes sensitive user information via CSV export mapping

October 21, 2025

Sensitive information disclosure occurs when an application inadvertently displays sensitive information to its users. Depending on the context, websites can leak all kinds of information including: • Data regarding other users, such as usernames and/or e-mail addresses • Sensitive commercial data such as customer names • Technical details about the website and/or the underlying infrastructure Disclosing technical details, such as detailed version information, allows malicious actors to look for targeted vulnerabilities and/or misconfigurations in the application or in the underlying infrastructure. In addition, an application is more likely to be targeted by attacks that specifically target a particular version of the software used.

References

  • github.com/advisories/GHSA-27c9-vp3w-6ww8
  • github.com/shopware/shopware
  • github.com/shopware/shopware/commit/c2c98050aff7b90fe7232f6dac9b6b7143183083
  • github.com/shopware/shopware/security/advisories/GHSA-27c9-vp3w-6ww8

Code Behaviors & Features

Detect and mitigate GHSA-27c9-vp3w-6ww8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 6.7.0.0 before 6.7.3.1, all versions before 6.6.10.7

Fixed versions

  • 6.7.3.1
  • 6.6.10.7

Solution

Upgrade to versions 6.6.10.7, 6.7.3.1 or above.

Impact 4.9 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

Source file

packagist/shopware/core/GHSA-27c9-vp3w-6ww8.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 02 Dec 2025 12:19:20 +0000.