CVE-2026-23498: Shopware

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

Affected products

• Shopware Shopware: from 6.7.0.0, before 6.7.6.1 (fixed in 6.7.6.1)

Published 2026-01-14. Last modified 2026-06-17.