CVE-2025-67648
High
Description
Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Shopware
PublishedDec 11, 2025
First seenDec 11, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- shopware shopware6.6.10.10, 6.7.5.1 or later
- shopware/shopware6.6.10.10, 6.7.5.1 or later
- shopware/storefront6.6.10.10, 6.7.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shopware shopware | 6.4.6.0 ≤ v < 6.6.10.10, 6.7.0.0 ≤ v < 6.7.5.1 | 6.6.10.10, 6.7.5.1 |
| shopware/shopwarePackagist | 6.4.6.0 ≤ v < 6.6.10.10, 6.7.0.0 ≤ v < 6.7.5.1 | 6.6.10.10, 6.7.5.1 |
| shopware/storefrontPackagist | 6.4.6.0 ≤ v < 6.6.10.10, 6.7.0.0 ≤ v < 6.7.5.1 | 6.6.10.10, 6.7.5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.