PT-2026-7163 · Shopware · Froshadminer+1

Gugiman + 1 · Published 2026-02-09 · Updated 2026-02-28 · CVE-2026-25878

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FroshAdminer versions prior to 2.2.1

Description The Adminer route ('/admin/adminer') within the FroshAdminer plugin for Shopware Platform was accessible without requiring Shopware admin authentication. The route was configured without authentication and session validation, potentially exposing the Adminer user interface to unauthorized users.

Recommendations Update FroshAdminer to version 2.2.1 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-25878

GHSA-F339-246P-WWJP

Affected Products

Froshadminer

Shopware/Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25878.json · Exploit
• https://github.com/FriendsOfShopware/FroshPlatformAdminer/security/advisories/GHSA-f339-246p-wwjp · Vendor Advisory
• https://github.com/FriendsOfShopware/FroshPlatformAdminer/commit/c4dd6c3462af178b3a7d146d3c651c2c253e902b · Patch
• https://osv.dev/vulnerability/CVE-2026-25878 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f339-246p-wwjp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25878 · Security Note
• https://github.com/FriendsOfShopware/FroshPlatformAdminer · Note
• https://github.com/FriendsOfShopware/FroshPlatformAdminer/releases/tag/2.2.1 · Note
• https://twitter.com/_cvereports/status/2021134564303790160 · Twitter Post
• https://twitter.com/CVEnew/status/2020972045341798733 · Twitter Post
• https://t.me/cveNotify/153607 · Telegram Post