Shopware is an open commerce platform.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Dec 11, 2025 · NIST NVD

   Detected

   Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter,

2. Oct 14, 2026 · NIST NVD

   Updated

   Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter,

Affected

• cpe shopware/shopwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-67648

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-67648

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2025-67648

  Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page wi

  nvd.nist.gov

References

• Patch · github.com
• Vendor Advisory · github.com