deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3cpp-fv95-mpr5
Package: shopware/core (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 6.6.10.7
Patched in: 6.6.10.7

Summary: Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

Details:
### Impact
This vulnerability allows malicious actors to force the application server to send HTTP requests to both external and internal servers. In certain cases, this may lead to access to internal resources such as databases, file systems, or other services that are not supposed to be directly accessible from the internet.

The overall impact of this vulnerability is considered limited, as the functionality is highly restricted and only processes IMG tags.

#### Description
Server-Side Request Forgery (SSRF) is a vulnerability that enables a malicious actor to manipulate an application server into performing HTTP requests to arbitrary domains. SSRF is commonly exploited to make the server initiate requests to its internal systems or other services within the same network, which are typically not exposed to external users. In some cases, SSRF can also be used to target external systems. A successful SSRF attack can result in unauthorized actions or access to data within the
organization, the web application itself, or other backend systems the application communicates with. In worst-case scenario, a SSRF vulnerability can be exploited to execute malicious code on the server.

#### Applicability 
The PDF generator used to create order invoices contains a Server-Side Request Forgery (SSRF)
vulnerability.
Administrative users can generate invoices for completed orders and have the option to add a note to the invoice. This input is currently not adequately filtered for (malicious) HTML characters. When a malicious actor submits an IMG tag as input, the PDF generator attempts to retrieve an external image while processing the IMG tag. As a result, the application server can be used to perform an HTTP request, enabling the malicious actors to reach both external and internal servers.
To exploit this vulnerability, an admin account is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in as an admin and navigate to the following URL:
https://<your-site>.shopware.store/admin#/sw/order/detail/0198e0afa2cb70ceb76ad64fc7864ca6/documents?limit=25&page=1&term=&sortBy&sortDirection=ASC&naturalSorting=false
2. Click the button ‘Create document’ and create a ‘Partial cancellation’ document.
3. As a comment add the following code:
```
<img src="<malicious image link>" width="250" height="100"/>
```
4. Press the preview button to view the PFD.
5. Observe that the image is shown in the PDF.
GitHub Security Advisory: GHSA-3cpp-fv95-mpr5
Package: shopware/core (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 6.7.0.0, < 6.7.3.1
Patched in: 6.7.3.1

Summary: Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

Details:
### Impact
This vulnerability allows malicious actors to force the application server to send HTTP requests to both external and internal servers. In certain cases, this may lead to access to internal resources such as databases, file systems, or other services that are not supposed to be directly accessible from the internet.

The overall impact of this vulnerability is considered limited, as the functionality is highly restricted and only processes IMG tags.

#### Description
Server-Side Request Forgery (SSRF) is a vulnerability that enables a malicious actor to manipulate an application server into performing HTTP requests to arbitrary domains. SSRF is commonly exploited to make the server initiate requests to its internal systems or other services within the same network, which are typically not exposed to external users. In some cases, SSRF can also be used to target external systems. A successful SSRF attack can result in unauthorized actions or access to data within the
organization, the web application itself, or other backend systems the application communicates with. In worst-case scenario, a SSRF vulnerability can be exploited to execute malicious code on the server.

#### Applicability 
The PDF generator used to create order invoices contains a Server-Side Request Forgery (SSRF)
vulnerability.
Administrative users can generate invoices for completed orders and have the option to add a note to the invoice. This input is currently not adequately filtered for (malicious) HTML characters. When a malicious actor submits an IMG tag as input, the PDF generator attempts to retrieve an external image while processing the IMG tag. As a result, the application server can be used to perform an HTTP request, enabling the malicious actors to reach both external and internal servers.
To exploit this vulnerability, an admin account is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in as an admin and navigate to the following URL:
https://<your-site>.shopware.store/admin#/sw/order/detail/0198e0afa2cb70ceb76ad64fc7864ca6/documents?limit=25&page=1&term=&sortBy&sortDirection=ASC&naturalSorting=false
2. Click the button ‘Create document’ and create a ‘Partial cancellation’ document.
3. As a comment add the following code:
```
<img src="<malicious image link>" width="250" height="100"/>
```
4. Press the preview button to view the PFD.
5. Observe that the image is shown in the PDF.
GitHub Security Advisory: GHSA-3cpp-fv95-mpr5
Package: shopware/platform (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 6.6.10.7
Patched in: 6.6.10.7

Summary: Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

Details:
### Impact
This vulnerability allows malicious actors to force the application server to send HTTP requests to both external and internal servers. In certain cases, this may lead to access to internal resources such as databases, file systems, or other services that are not supposed to be directly accessible from the internet.

The overall impact of this vulnerability is considered limited, as the functionality is highly restricted and only processes IMG tags.

#### Description
Server-Side Request Forgery (SSRF) is a vulnerability that enables a malicious actor to manipulate an application server into performing HTTP requests to arbitrary domains. SSRF is commonly exploited to make the server initiate requests to its internal systems or other services within the same network, which are typically not exposed to external users. In some cases, SSRF can also be used to target external systems. A successful SSRF attack can result in unauthorized actions or access to data within the
organization, the web application itself, or other backend systems the application communicates with. In worst-case scenario, a SSRF vulnerability can be exploited to execute malicious code on the server.

#### Applicability 
The PDF generator used to create order invoices contains a Server-Side Request Forgery (SSRF)
vulnerability.
Administrative users can generate invoices for completed orders and have the option to add a note to the invoice. This input is currently not adequately filtered for (malicious) HTML characters. When a malicious actor submits an IMG tag as input, the PDF generator attempts to retrieve an external image while processing the IMG tag. As a result, the application server can be used to perform an HTTP request, enabling the malicious actors to reach both external and internal servers.
To exploit this vulnerability, an admin account is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in as an admin and navigate to the following URL:
https://<your-site>.shopware.store/admin#/sw/order/detail/0198e0afa2cb70ceb76ad64fc7864ca6/documents?limit=25&page=1&term=&sortBy&sortDirection=ASC&naturalSorting=false
2. Click the button ‘Create document’ and create a ‘Partial cancellation’ document.
3. As a comment add the following code:
```
<img src="<malicious image link>" width="250" height="100"/>
```
4. Press the preview button to view the PFD.
5. Observe that the image is shown in the PDF.
GitHub Security Advisory: GHSA-3cpp-fv95-mpr5
Package: shopware/platform (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 6.7.0.0, < 6.7.3.1
Patched in: 6.7.3.1

Summary: Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

Details:
### Impact
This vulnerability allows malicious actors to force the application server to send HTTP requests to both external and internal servers. In certain cases, this may lead to access to internal resources such as databases, file systems, or other services that are not supposed to be directly accessible from the internet.

The overall impact of this vulnerability is considered limited, as the functionality is highly restricted and only processes IMG tags.

#### Description
Server-Side Request Forgery (SSRF) is a vulnerability that enables a malicious actor to manipulate an application server into performing HTTP requests to arbitrary domains. SSRF is commonly exploited to make the server initiate requests to its internal systems or other services within the same network, which are typically not exposed to external users. In some cases, SSRF can also be used to target external systems. A successful SSRF attack can result in unauthorized actions or access to data within the
organization, the web application itself, or other backend systems the application communicates with. In worst-case scenario, a SSRF vulnerability can be exploited to execute malicious code on the server.

#### Applicability 
The PDF generator used to create order invoices contains a Server-Side Request Forgery (SSRF)
vulnerability.
Administrative users can generate invoices for completed orders and have the option to add a note to the invoice. This input is currently not adequately filtered for (malicious) HTML characters. When a malicious actor submits an IMG tag as input, the PDF generator attempts to retrieve an external image while processing the IMG tag. As a result, the application server can be used to perform an HTTP request, enabling the malicious actors to reach both external and internal servers.
To exploit this vulnerability, an admin account is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in as an admin and navigate to the following URL:
https://<your-site>.shopware.store/admin#/sw/order/detail/0198e0afa2cb70ceb76ad64fc7864ca6/documents?limit=25&page=1&term=&sortBy&sortDirection=ASC&naturalSorting=false
2. Click the button ‘Create document’ and create a ‘Partial cancellation’ document.
3. As a comment add the following code:
```
<img src="<malicious image link>" width="250" height="100"/>
```
4. Press the preview button to view the PFD.
5. Observe that the image is shown in the PDF.
GitHub Security Advisory: GHSA-6wh5-mw9h-5c3w
Package: shopware/core (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 6.6.10.7
Patched in: 6.6.10.7

Summary: Shopware vulnerable to path traversal via Plugin upload

Details:
### Impact
Malicious actors can exploit this vulnerability to write files within arbitrary directories on the filesystem of the Shopware web container. This could allow them to gain persistent shell access by uploading a PHP-shell file to an accessible folder.

It is important to note that this vulnerability is only present on on-premises installation of Shopware and not present on the SaaS installation due to additional security checks being implemented on the uploaded plugin files.

#### Description
A path traversal vulnerability allows malicious actors to access files and folders that are outside the folder structure accessible to the affected function. This vulnerability occurs when an application uses unfiltered user input to point to the path of a specific file and retrieve it. This can result in gaining read/write access to sensitive information, application code, back-end systems and other (critical) files on the operating system. In certain cases, it is even possible to store arbitrary files outside the relevant directory structure on the server in order to gain access to the server.

#### Applicability
The Plugin upload function in use by the Shopware application is vulnerable to path traversal.
Within the on-premises version of the Shopware application users are able to extend the functionality of the application by installing ‘plugins’ also referred to as ‘apps’ or ‘extensions’. These plugins can be installed using the official store or by uploading a zip file containing the required files. To prevent path traversal the Shopware application implements a check that effectively prohibits files containing ‘..’ characters from being uploaded. During review of the source code, it was noticed that the check for the prohibited characters was only performed from the third entry (index 2) of the uploaded Zip file. This means that the second entry (index 1) within the Zip file can contain path traversal characters and thus allows files to be written in
directories outside of the intended plugins folder.

To exploit this vulnerability, an admin account with permissions to upload plugins, is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in to an on-premises Shopware application with an admin account with permissions to
upload plugins.
2. Create a malicious Zip file using the script provided in evidence 5.
3. Upload the generated malicious Zip file as a new plugin within the application
4. Access the filesystem of the Shopware application
5. Navigate to the path below:
/var/www/html/custom/apps
6. Notice that an ‘evil.php’ file has been extracted within this folder.
GitHub Security Advisory: GHSA-6wh5-mw9h-5c3w
Package: shopware/core (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.7.0.0, < 6.7.3.1
Patched in: 6.7.3.1

Summary: Shopware vulnerable to path traversal via Plugin upload

Details:
### Impact
Malicious actors can exploit this vulnerability to write files within arbitrary directories on the filesystem of the Shopware web container. This could allow them to gain persistent shell access by uploading a PHP-shell file to an accessible folder.

It is important to note that this vulnerability is only present on on-premises installation of Shopware and not present on the SaaS installation due to additional security checks being implemented on the uploaded plugin files.

#### Description
A path traversal vulnerability allows malicious actors to access files and folders that are outside the folder structure accessible to the affected function. This vulnerability occurs when an application uses unfiltered user input to point to the path of a specific file and retrieve it. This can result in gaining read/write access to sensitive information, application code, back-end systems and other (critical) files on the operating system. In certain cases, it is even possible to store arbitrary files outside the relevant directory structure on the server in order to gain access to the server.

#### Applicability
The Plugin upload function in use by the Shopware application is vulnerable to path traversal.
Within the on-premises version of the Shopware application users are able to extend the functionality of the application by installing ‘plugins’ also referred to as ‘apps’ or ‘extensions’. These plugins can be installed using the official store or by uploading a zip file containing the required files. To prevent path traversal the Shopware application implements a check that effectively prohibits files containing ‘..’ characters from being uploaded. During review of the source code, it was noticed that the check for the prohibited characters was only performed from the third entry (index 2) of the uploaded Zip file. This means that the second entry (index 1) within the Zip file can contain path traversal characters and thus allows files to be written in
directories outside of the intended plugins folder.

To exploit this vulnerability, an admin account with permissions to upload plugins, is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in to an on-premises Shopware application with an admin account with permissions to
upload plugins.
2. Create a malicious Zip file using the script provided in evidence 5.
3. Upload the generated malicious Zip file as a new plugin within the application
4. Access the filesystem of the Shopware application
5. Navigate to the path below:
/var/www/html/custom/apps
6. Notice that an ‘evil.php’ file has been extracted within this folder.
GitHub Security Advisory: GHSA-6wh5-mw9h-5c3w
Package: shopware/platform (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 6.6.10.7
Patched in: 6.6.10.7

Summary: Shopware vulnerable to path traversal via Plugin upload

Details:
### Impact
Malicious actors can exploit this vulnerability to write files within arbitrary directories on the filesystem of the Shopware web container. This could allow them to gain persistent shell access by uploading a PHP-shell file to an accessible folder.

It is important to note that this vulnerability is only present on on-premises installation of Shopware and not present on the SaaS installation due to additional security checks being implemented on the uploaded plugin files.

#### Description
A path traversal vulnerability allows malicious actors to access files and folders that are outside the folder structure accessible to the affected function. This vulnerability occurs when an application uses unfiltered user input to point to the path of a specific file and retrieve it. This can result in gaining read/write access to sensitive information, application code, back-end systems and other (critical) files on the operating system. In certain cases, it is even possible to store arbitrary files outside the relevant directory structure on the server in order to gain access to the server.

#### Applicability
The Plugin upload function in use by the Shopware application is vulnerable to path traversal.
Within the on-premises version of the Shopware application users are able to extend the functionality of the application by installing ‘plugins’ also referred to as ‘apps’ or ‘extensions’. These plugins can be installed using the official store or by uploading a zip file containing the required files. To prevent path traversal the Shopware application implements a check that effectively prohibits files containing ‘..’ characters from being uploaded. During review of the source code, it was noticed that the check for the prohibited characters was only performed from the third entry (index 2) of the uploaded Zip file. This means that the second entry (index 1) within the Zip file can contain path traversal characters and thus allows files to be written in
directories outside of the intended plugins folder.

To exploit this vulnerability, an admin account with permissions to upload plugins, is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in to an on-premises Shopware application with an admin account with permissions to
upload plugins.
2. Create a malicious Zip file using the script provided in evidence 5.
3. Upload the generated malicious Zip file as a new plugin within the application
4. Access the filesystem of the Shopware application
5. Navigate to the path below:
/var/www/html/custom/apps
6. Notice that an ‘evil.php’ file has been extracted within this folder.
GitHub Security Advisory: GHSA-6wh5-mw9h-5c3w
Package: shopware/platform (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.7.0.0, < 6.7.3.1
Patched in: 6.7.3.1

Summary: Shopware vulnerable to path traversal via Plugin upload

Details:
### Impact
Malicious actors can exploit this vulnerability to write files within arbitrary directories on the filesystem of the Shopware web container. This could allow them to gain persistent shell access by uploading a PHP-shell file to an accessible folder.

It is important to note that this vulnerability is only present on on-premises installation of Shopware and not present on the SaaS installation due to additional security checks being implemented on the uploaded plugin files.

#### Description
A path traversal vulnerability allows malicious actors to access files and folders that are outside the folder structure accessible to the affected function. This vulnerability occurs when an application uses unfiltered user input to point to the path of a specific file and retrieve it. This can result in gaining read/write access to sensitive information, application code, back-end systems and other (critical) files on the operating system. In certain cases, it is even possible to store arbitrary files outside the relevant directory structure on the server in order to gain access to the server.

#### Applicability
The Plugin upload function in use by the Shopware application is vulnerable to path traversal.
Within the on-premises version of the Shopware application users are able to extend the functionality of the application by installing ‘plugins’ also referred to as ‘apps’ or ‘extensions’. These plugins can be installed using the official store or by uploading a zip file containing the required files. To prevent path traversal the Shopware application implements a check that effectively prohibits files containing ‘..’ characters from being uploaded. During review of the source code, it was noticed that the check for the prohibited characters was only performed from the third entry (index 2) of the uploaded Zip file. This means that the second entry (index 1) within the Zip file can contain path traversal characters and thus allows files to be written in
directories outside of the intended plugins folder.

To exploit this vulnerability, an admin account with permissions to upload plugins, is required.

#### Reproduction
To reproduce this vulnerability, the steps below can be followed.
1. Log in to an on-premises Shopware application with an admin account with permissions to
upload plugins.
2. Create a malicious Zip file using the script provided in evidence 5.
3. Upload the generated malicious Zip file as a new plugin within the application
4. Access the filesystem of the Shopware application
5. Navigate to the path below:
/var/www/html/custom/apps
6. Notice that an ‘evil.php’ file has been extracted within this folder.
GitHub Security Advisory: GHSA-m895-2hj3-8cg9
Package: shopware/core (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 6.6.10.7
Patched in: 6.6.10.7

Summary: Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

Details:
In Shopware core and platform versions before 6.6.10.7 and 6.7.3.1, media visibility restrictions applied by MediaVisibilityRestrictionSubscriber are not enforced for aggregation API requests. Authorization filters are only injected during standard entity reads; aggregation queries can be constructed to bypass these checks and enumerate private media records such as invoices or other restricted documents. A low‑privilege backend user (e.g., product editor) can chain normal business flows (creating or viewing orders) with aggregation queries to disclose sensitive customer data including addresses and payment-related information contained within associated private media. The issue is resolved in 6.6.10.7 and 6.7.3.1.