Vulnerability · Published Jan 22, 2026 · Assigned by GitHub_M

CVE-2026-23959CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

Medium 6.9

In plain English

A medium-severity security flaw in CoreShop from coreshop. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 63.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. Version 4.1.9 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	coreshop/core-shop	4.1.9	GHSA-fqcv-8859-86x2

Affected products (as reported)

Vendor	Product	Versions
coreshop	CoreShop	< 4.1.9

Weakness: CWE-564 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/coreshop/CoreShop/security/advisories/GHSA-fqcv-8859-86x2 x_refsource_CONFIRM
https://github.com/coreshop/CoreShop/commit/af80b8f5c7df5f02f44e9c5e0a4a564de274eec2 x_refsource_MISC
https://github.com/coreshop/CoreShop/releases/tag/4.1.9 x_refsource_MISC