Listen to this Post
The vulnerability is a regression of a prior patch for CVE-2023-2017 in the Twig templating engine. The original fix restricted the execution of functions within Twig filters to an allow list. However, a regression allowed an attacker to bypass this restriction by passing a specially crafted PHP Closure object within an array to the `map()` filter. The Twig rendering process would incorrectly process this array structure, executing the encapsulated Closure without validating it against the function allow list. This flaw in the code generation control for rendered views enables authenticated backend users with certain privileges to achieve remote code execution on the underlying server by injecting and executing arbitrary PHP code through manipulated Twig template parameters.
Platform: Shopware
Version: < 6.7.6.1
Vulnerability: Twig Code Injection
Severity: Critical
Date: 2026-01-14
Prediction: 2026-01-14
What Undercode Say:
curl -s http://target/shopware/ | grep version
{{ ['id']|map((arg)=>"phpinfo")|filter((v,k)=>system(v)) }}
// Malicious Closure payload
$closure = function() { system('id'); };
How Exploit:
Authenticated backend user injects a crafted array containing a PHP Closure into a Twig template parameter. The `map` filter executes the Closure, bypassing function allow lists to run system commands.
Protection from this CVE:
Apply patch 6.7.6.1. Install Security Plugin. Restrict backend permissions.
Impact:
Remote Code Execution. System compromise. Data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
