{"action":"Upgrade shopware/core to 6.4.3.1 or later.","affected":[{"fixed":"6.4.3.1","introduced":"0"}],"component":"shopware/core","cve_ids":["CVE-2021-37711"],"ecosystem":"Packagist","epss":0.01058,"exploited":false,"fixed_versions":["6.4.3.1"],"ghsa_id":"GHSA-gcvv-gq92-x94r","id":"tcs_01M5KF2N9AJ99NM2MPV6FZ86B2","modified_at":"2026-09-10T03:49:08.032812285Z","published_at":"2021-08-23T19:42:49Z","references":["https://osv.dev/vulnerability/GHSA-gcvv-gq92-x94r","https://github.com/shopware/platform/security/advisories/GHSA-gcvv-gq92-x94r","https://nvd.nist.gov/vuln/detail/CVE-2021-37711","https://github.com/shopware/platform/commit/b9f330e652b743dd2374c02bbe68f28b59a3f502","https://github.com/shopware/platform"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-gcvv-gq92-x94r#Packagist/shopware/core","url":"https://osv.dev/vulnerability/GHSA-gcvv-gq92-x94r"}],"summary":"Authenticated server-side request forgery in file upload via URL."}