PT-2026-53768 · Packagist · Craftcms/Commerce

Publicado 2026-06-19 · Atualizado 2026-06-19

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

The Order::setPaymentAmount() method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.

Details

When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.

Remediation

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-1284

Identificadores relacionados

GHSA-78VR-Q6CF-C7P6

Produtos afetados

Craftcms/Commerce

Referências · 4

• https://github.com/craftcms/commerce/security/advisories/GHSA-78vr-q6cf-c7p6 · Nota
• https://github.com/craftcms/commerce/commit/9a88392b3074aa132a9455d4f4b582411df52c74 · Nota
• https://github.com/craftcms/commerce · Nota
• https://osv.dev/vulnerability/GHSA-78vr-q6cf-c7p6 · Aviso do Fabricante