PT-2026-57038 · Packagist · Sylius/Sylius

Published

2026-07-09

·

Updated

2026-07-09

·

CVE-2026-53637

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact

A user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes the status, or the user finalizes payment in another tab. The browser still displays the old cart: the LiveComponent is unaware the underlying order state has changed.
If the user then:
  • clears the cart → clearCart() calls manager->remove() on the completed order: the order is permanently deleted from the database;
  • removes a product → removeItem() mutates an item on the completed order;
  • changes quantity → saveCart() overwrites data on the completed order.
In all cases, the customer's order data is irreversibly corrupted or lost, even though the order has already been placed and paid for. The same vector can be triggered deliberately by an authenticated customer (keep the cart page open, complete checkout in another tab, then modify the "cart" to add quantity beyond what was paid for).

Patches

The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above.

Workarounds

If users cannot update Sylius immediately, they should create a patched copy of the affected class in their application's src/ directory and override the Sylius service definition to use it.

Step 1. Create src/Twig/Component/Cart/FormComponent.php

php
<?php

declare(strict types=1);

namespace AppTwigComponentCart;

use DoctrinePersistenceObjectManager;
use SyliusBundleUiBundleTwigComponentResourceFormComponentTrait;
use SyliusBundleUiBundleTwigComponentTemplatePropTrait;
use SyliusComponentCoreModelOrderInterface;
use SyliusComponentCoreOrderCheckoutStates;
use SyliusComponentCoreRepositoryOrderRepositoryInterface;
use SyliusComponentOrderSyliusCartEvents;
use SyliusResourceModelResourceInterface;
use SymfonyComponentEventDispatcherEventDispatcherInterface;
use SymfonyComponentEventDispatcherGenericEvent;
use SymfonyComponentFormFormFactoryInterface;
use SymfonyUXLiveComponentAttributeLiveAction;
use SymfonyUXLiveComponentAttributeLiveArg;
use SymfonyUXLiveComponentAttributePreReRender;
use SymfonyUXLiveComponentComponentToolsTrait;

class FormComponent
{
  use ComponentToolsTrait;

  /** @use ResourceFormComponentTrait<OrderInterface> */
  use ResourceFormComponentTrait;

  use TemplatePropTrait;

  public const SYLIUS SHOP CART CHANGED = 'sylius:shop:cart changed';

  public const SYLIUS SHOP CART CLEARED = 'sylius:shop:cart cleared';

  public bool $shouldSaveCart = true;

  /** @param OrderRepositoryInterface<OrderInterface> $orderRepository */
  public function  construct(
    OrderRepositoryInterface $orderRepository,
    FormFactoryInterface $formFactory,
    string $resourceClass,
    string $formClass,
    protected readonly ObjectManager $manager,
    protected readonly EventDispatcherInterface $eventDispatcher,
  ) {
    $this->initialize($orderRepository, $formFactory, $resourceClass, $formClass);
  }

  public function hydrateResource(mixed $value): ?ResourceInterface
  {
    if (empty($value)) {
      return $this->createResource();
    }

    /** @var OrderInterface|null $order */
    $order = $this->repository->find($value);

    if (
      !$order instanceof OrderInterface
      || $order->getCheckoutState() === OrderCheckoutStates::STATE COMPLETED
    ) {
      return $this->createResource();
    }

    return $order;
  }

  #[PreReRender(priority: -100)]
  public function saveCart(): void
  {
    if ($this->shouldSaveCart && $this->resource?->getId() !== null) {
      $form = $this->getForm();
      if ($form->isValid()) {
        $this->eventDispatcher->dispatch(new GenericEvent($form->getData()), SyliusCartEvents::CART CHANGE);
        $this->manager->flush();
        $this->emit(self::SYLIUS SHOP CART CHANGED, ['cartId' => $this->resource->getId()]);
      }
    }
  }

  #[LiveAction]
  public function removeItem(#[LiveArg] int $index): void
  {
    if ($this->resource?->getId() === null) {
      return;
    }

    $data = $this->formValues['items'];
    unset($data[$index]);
    $this->formValues['items'] = array values($data);

    $orderItem = $this->resource->getItems()->get($index);
    $this->eventDispatcher->dispatch(new GenericEvent($orderItem), SyliusCartEvents::CART ITEM REMOVE);

    $this->manager->persist($this->resource);
    $this->manager->flush();
    $this->manager->refresh($this->resource);

    $this->shouldSaveCart = false;
    $this->submitForm();
    $this->emit(self::SYLIUS SHOP CART CHANGED, ['cartId' => $this->resource->getId()]);
  }

  #[LiveAction]
  public function clearCart(): void
  {
    if ($this->resource?->getId() === null) {
      return;
    }

    $this->formValues['items'] = [];
    $this->eventDispatcher->dispatch(new GenericEvent($this->resource), SyliusCartEvents::CART CLEAR);
    $this->manager->remove($this->resource);
    $this->manager->flush();

    $this->resource = $this->createResource();
    $this->resetForm();
    $this->isValidated = false;
    $this->validatedFields = [];

    $this->shouldSaveCart = false;
    $this->submitForm();
    $this->emit(self::SYLIUS SHOP CART CLEARED);
  }

  #[LiveAction]
  public function removeCoupon(): void
  {
    $this->formValues['promotionCoupon'] = '';

    $this->submitForm();
  }

  private function getDataModelValue(): string
  {
    return 'debounce(500)|*';
  }
}

Step 2. Override the Sylius service in config/services.yaml

Append to the application's config/services.yaml (or a dedicated file loaded by the kernel, e.g. config/packages/sylius security cart.yaml):
yaml
services:
  sylius shop.twig.component.cart.form:
    class: AppTwigComponentCartFormComponent
    arguments:
      - '@sylius.repository.order'
      - '@form.factory'
      - '%sylius.model.order.class%'
      - 'SyliusBundleShopBundleFormTypeCartType'
      - '@doctrine.orm.entity manager'
      - '@event dispatcher'
    calls:
      - [setLiveResponder, ['@ux.live component.live responder']]
    tags:
      - { name: sylius.live component.shop, key: 'sylius shop:cart:form' }
This redeclares the existing Sylius service id sylius shop.twig.component.cart.form so it instantiates the patched class from App while preserving every argument, call and tag from the original Sylius XML definition. The cart twig hook keeps resolving to the same Live Component key (sylius shop:cart:form).

Step 3. Clear the cache

bash
bin/console cache:clear

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:
  • Kévin Gonella (@kgonella)
  • Sam V.

For more information

If there are any questions or comments about this advisory:

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-672CWE-841

Related Identifiers

CVE-2026-53637
GHSA-5597-7RMH-97Q5

Affected Products

Sylius/Sylius