PT-2026-24473 · Sylius · Sylius

Bartłomiej Nowiński · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-31819

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.9.12 Sylius versions prior to 1.10.16 Sylius versions prior to 1.11.17 Sylius versions prior to 1.12.23 Sylius versions prior to 1.13.15 Sylius versions prior to 1.14.18 Sylius versions prior to 2.0.16 Sylius versions prior to 2.1.12 Sylius versions prior to 2.2.3

Description Sylius, an Open Source eCommerce Framework on Symfony, is susceptible to a redirect issue due to the direct use of the HTTP Referer header in CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction(), and StorageBasedLocaleSwitcher::handle() when performing redirects. An attacker can exploit this by tricking a user into clicking a legitimate application link hosted on a malicious website. The browser then sends the attacker’s site as the Referer, causing the application to redirect back to it. This can lead to phishing or credential theft, as the redirect appears to originate from a trusted domain. Public endpoints are easily exploitable without authentication, while admin-only endpoints require an authenticated session but are still vulnerable if an administrator follows a link from an external source.

Recommendations Versions prior to 1.9.12 should be updated to version 1.9.12 or later. Versions prior to 1.10.16 should be updated to version 1.10.16 or later. Versions prior to 1.11.17 should be updated to version 1.11.17 or later. Versions prior to 1.12.23 should be updated to version 1.12.23 or later. Versions prior to 1.13.15 should be updated to version 1.13.15 or later. Versions prior to 1.14.18 should be updated to version 1.14.18 or later. Versions prior to 2.0.16 should be updated to version 2.0.16 or later. Versions prior to 2.1.12 should be updated to version 2.1.12 or later. Versions prior to 2.2.3 should be updated to version 2.2.3 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-31819

GHSA-9FFX-F77R-756W

Affected Products

Sylius

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31819.json · Exploit
• https://github.com/Sylius/Sylius/security/advisories/GHSA-9ffx-f77r-756w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9ffx-f77r-756w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31819 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31819 · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://twitter.com/CVEnew/status/2031504083115188590 · Twitter Post