CVE-2026-31819 Details
Description
Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's site as the Referer, and the application redirects back to it. This can be used for phishing or credential theft, as the redirect originates from a trusted domain. The severity varies by endpoint; public endpoints require no authentication and are trivially exploitable, while admin-only endpoints require an authenticated session but remain vulnerable if an admin follows a link from an external source such as email or chat. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.
A moderate open redirect vulnerability has been identified in Sylius, an open-source eCommerce framework built on Symfony. The issue arises in the CurrencySwitchController, ImpersonateUserController, and StorageBasedLocaleSwitcher, all of which use the HTTP Referer header for redirection. This vulnerability can be exploited by tricking a user into clicking a link on an attacker-controlled page, which then redirects back to the attacker's site, potentially leading to phishing or credential theft. Public endpoints are easily exploitable, while admin-only endpoints require an authenticated session.
To address this vulnerability, users can update Sylius to version 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, or 2.2.3 and above. If an immediate update is not possible, the affected controllers can be copied to the project's source directory, modified to remove the referer-based redirection, and the service definitions overridden.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sylius/Sylius/security/advisories/GHSA-9ffx-f77r-756w | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sylius sylius | < 1.9.12 >= 1.10.0, < 1.10.16 >= 1.11.0, < 1.11.17 >= 1.12.0, < 1.12.23 >= 1.13.0, < 1.13.15 >= 1.14.0, < 1.14.18 >= 2.0.0, < 2.0.16 >= 2.1.0, < 2.1.12 >= 2.2.0, < 2.2.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |