CVE-2026-23498
Published: 14 January 2026
Summary
CVE-2026-23498 is a high-severity Code Injection (CWE-94) vulnerability in Shopware Shopware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23498 is a code injection vulnerability (CWE-94) affecting Shopware, an open commerce platform. It stems from a regression of CVE-2023-2017 in versions 6.7.0.0 through 6.7.6.0, where an array-crafted PHP Closure is not properly checked against an allow list in the map(...) override function. The issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-14.
An authenticated attacker with high privileges, such as an administrator, can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows high-impact compromise, including unauthorized access to sensitive data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), potentially leading to full server control within the affected scope.
Shopware's security advisory (GHSA-7cw6-7h3h-v8pf) and the fixing commit (3966b05590e29432b8485ba47b4fcd14dd0b8475) confirm the vulnerability is patched in version 6.7.6.1. Security practitioners should prioritize upgrading affected Shopware instances to 6.7.6.1 or later to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2421
Vulnerability details
Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote code injection (CWE-94) in publicly accessible Shopware web application enables exploitation of public-facing apps for arbitrary code execution and full server compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of inputs against an allow list, which is the exact control failure that permits the crafted PHP Closure in the map() override.
Mandates timely remediation of known flaws; applying the 6.7.6.1 patch eliminates the regression of CVE-2023-2017.
Restricts the set of privileged accounts that can reach the vulnerable map() function, reducing the population able to supply the malicious Closure.