CVE-2026-53637
Description
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.
How to fix
- sylius/sylius2.0.18, 2.1.15, 2.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sylius/syliusPackagist | 2.0.0 ≤ v < 2.0.18, 2.1.0 ≤ v < 2.1.15, 2.2.0 ≤ v < 2.2.6 | 2.0.18, 2.1.15, 2.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.