Private files publicly accessible with Cloud Storage providers

published 2021-06-24 5 y ago modified 2026-09-10 1 mo ago also GHSA-6gr8-c3m5-mvrg , GHSA-vrf2-xghr-j52v , EUVD-2021-1994

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits: 0; none known

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.

Patch / fix

fixed in 3 links 2

packagist shopware/platform 6.4.1.1
packagist shopware/core 6.4.1.1
shopware shopware 6.4.1.1

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	shopware/platform	<6.4.1.1	6.4.1.1
packagist	shopware/core	<6.4.1.1	6.4.1.1

Affected products

shopware platform

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-732 Incorrect Permission Assignment for Critical Resource

References

github.com /shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3
web, patch, third-party-advisory
docs.shopware.com /en/shopware-6-en/security-updates/security-update-06-2021
web, patch, vendor-advisory
github.com /shopware/platform/security/advisories/GHSA-vrf2-xghr-j52v
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-32717
advisory
github.com /shopware/platform
package

Sources

CVE List CVE-2021-32717
GitHub Advisory GHSA-6gr8-c3m5-mvrg
GitHub Advisory GHSA-vrf2-xghr-j52v
NVD CVE-2021-32717

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary