Presentation
Shopware 6 is an open-source e-commerce platform. Its App system lets extensions ship App Scripts, Twig templates executed server-side inside a sandbox that is supposed to restrict them to a safe subset of functions.
HDW Sec found a way out of that sandbox: a malicious or compromised app installed and activated on a shop can execute arbitrary PHP functions and operating-system commands with the privileges of the web server process. Shopware rated it critical, 9.6.
Issue(s)
- The Twig sandbox restricts the callables an App Script may reach through an allow-list, but a filter reachable from the sandbox resolves callables that the list was never meant to expose.
- From there, arbitrary PHP functions can be called, and through them operating-system commands, with the permissions of the PHP or web server process.
- The consequence is full compromise of the shop: access to configuration and credentials, modification of any file the process can write, access to internal services, and disruption of the shop.
- The scope is changed (
S:C): the escape crosses the sandbox boundary that the security model relies on.
References
- GitHub advisory: GHSA-6qhw-38wm-7g7h
- Fixed in Shopware 6.6.10.23 and 6.7.13.1, published 2026-08-25. No CVE assigned as of publication.