Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Sylius bug bounty programs

sylius.com Updated

Sylius runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
15
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Sylius runs.

  • Sylius

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

15 targets. 6 excluded.

  • https://sylius.com

    Web

  • Admin user impersonation, the fixtures loader and the installer

    Products and areas

  • Authentication and session handling on both the shop and the admin firewalls

    Products and areas

  • Customer accounts, the address book, order history and the credentials attached to them

    Products and areas

  • Payment method configuration and the gateway integration layer, including every callback or notification route a provider uses to report a payment

    Products and areas

  • Product, taxon and attribute administration, plus image and file uploads

    Products and areas

  • Promotions, coupons and the promotion rule and action configuration behind them

    Products and areas

  • The admin panel and the Symfony security voters that authorise each admin action

    Products and areas

  • The API, built on API Platform, including every exposed resource, operation and serialization group

    Products and areas

  • The channel model, where one installation serves several storefronts with separate pricing, locales and currencies

    Products and areas

  • The order processing pipeline: unit pricing, promotion application, shipping cost calculation and tax resolution

    Products and areas

  • The policy takes private reports at a dedicated security address on maintained Sylius versions and links its release and support process rather than carving out components. The whole framework is in scope

    Products and areas

  • The resource bundle's generic CRUD routes, which expose create, read, update and delete over configured resources

    Products and areas

  • The shop front end: catalogue, cart, the checkout state machine and the customer account area

    Products and areas

  • The Twig template and theme layer, and anywhere merchant-editable content is rendered

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Branches outside the maintained set the release policy defines

  • Deployment and hosting configuration choices

  • Merchant customisations, overrides and bespoke bundles written on top of Sylius, which are the merchant's own application

  • Payment gateway providers' own systems, which are separate estates

  • Symfony and other upstream dependency issues, unless Sylius's own use of the component is what makes the defect reachable

  • Third-party Sylius plugins maintained outside the core repository

Recent changes

Reward and scope changes across every Sylius program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Sylius products, from the NVD.

Search NVD
  • CVE-2026-31821 Medium

    Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation

  • CVE-2026-31822 Medium

    Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and

  • CVE-2026-31823 Medium

    Sylius is an Open Source eCommerce Framework on Symfony. An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML. Shop breadcrumbs (shared/breadcrumbs.html.twig): The breadcrumbs macro uses the Twig |raw filter on label values. Since taxon names, product names, and

  • CVE-2026-31824 High

    Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit (the global used counter on Promotion entities), coupon usage limit (the global used counter on PromotionCoupon entities), and coupon per-customer usage limit (the p

  • CVE-2026-31825 Medium

    Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.

  • CVE-2026-31819 Medium

    Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's si

  • CVE-2026-31820 High

    Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that accepts a resource ID via #[LiveArg] and loads it wi

  • CVE-2024-57610 High

    A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to us

About this page

This page gathers every public program listed under sylius.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.