GHSA-3pcr-4982-548m

Source

https://github.com/advisories/GHSA-3pcr-4982-548m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-3pcr-4982-548m/GHSA-3pcr-4982-548m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3pcr-4982-548m

Published

2021-04-13T15:13:37Z

Modified

2026-09-10T03:49:02Z

Summary

Exposure of .env if project root is configured as web root in shopware/production

Details

Impact

The .env and other sensitive files can be leaked if the project root and not /public is configured as the web root.

Patches

We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

You should always use /public as the web root.

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

For more information

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021

Database specific

{
    "cwe_ids": [
        "CWE-552"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-12T22:33:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

Packagist / shopware/production

Package

Name: shopware/production
Purl: pkg:composer/shopware/production

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.3.5.3

Affected versions

v6.*

v6.1.0-rc1

v6.1.0-rc2

v6.1.0-rc3

v6.1.0

v6.1.1

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.2.0-RC1

v6.2.0

v6.2.1

v6.2.2

v6.2.3

v6.3.0.0

v6.3.0.1

v6.3.0.2

v6.3.1.0

v6.3.1.1

v6.3.2.0

v6.3.2.1

v6.3.3.0

v6.3.3.1

v6.3.4.0

v6.3.4.1

v6.3.5.0

v6.3.5.1

v6.3.5.2

Database specific

last_known_affected_version_range

"<= 6.3.5.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-3pcr-4982-548m/GHSA-3pcr-4982-548m.json"

Packagist / shopware/shopware

Package

Name: shopware/shopware
Purl: pkg:composer/shopware/shopware

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.3.5.3

Affected versions

1.*

1.0.2

1.0.8

4.*

4.2.0-rc.1

4.2.0

4.2.1

4.2.1.1

4.2.2

4.2.3

4.3.0

4.3.1

4.3.2

4.3.3

4.3.4

4.3.5

4.3.6

4.3.7

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.0.0-RC2

v5.0.0-RC3

v5.0.0

v5.0.1

v5.0.2-RC1

v5.0.2

v5.0.3-RC1

v5.0.3

v5.0.4-RC1

v5.0.4

v5.1.0-RC2

v5.1.0-RC3

v5.1.0

v5.1.1

v5.1.2-RC1

v5.1.2-RC2

v5.1.2

v5.1.3-RC1

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v5.2.0-BETA1

v5.2.0-RC1

v5.2.0-RC2

v5.2.0-RC3

v5.2.0

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.2.5

v5.2.6

v5.2.7

v5.2.8

v5.2.9

v5.2.10

v5.2.11

v5.2.12

v5.2.13

v5.2.14

v5.2.15

v5.2.16

v5.2.17

v5.2.18

v5.2.19

v5.2.20

v5.2.21

v5.2.22

v5.2.23

v5.2.24

v5.2.25

v5.2.26

v5.2.27

v5.3.4

v5.3.5

v5.3.6

v5.3.7

v5.4.0-RC1

v5.4.0

v5.4.1

v5.4.2

v5.4.3

v5.4.4

v5.4.5

v5.4.6

v5.5.0-BETA1

v5.5.0-RC1

v5.5.0

v5.5.1

v5.5.2

v5.5.3

v5.5.4

v5.5.5

v5.5.6

v5.5.7

v5.5.8

v5.5.9

v5.5.10

v5.6.0-RC1

v5.6.0

v5.6.1

v5.6.2

v5.6.3

v5.6.4

v5.6.5

v5.6.6

v5.6.7

v5.6.8

v5.6.9

v5.6.10

v5.7.0-RC1

v5.7.0-RC2

v5.7.0

v5.7.1

v5.7.2

v5.7.3

v5.7.4

v5.7.5

v5.7.6

v5.7.7

v5.7.8

v5.7.9

v5.7.10

v5.7.11

v5.7.12

v5.7.13

v5.7.14

v5.7.15

v5.7.16-RC1

v5.7.16

v5.7.17-RC1

v5.7.17

v5.7.18

v5.7.19

v5.7.20

5.*

5.3.0

Database specific

last_known_affected_version_range

"<= 6.3.5.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-3pcr-4982-548m/GHSA-3pcr-4982-548m.json"