- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 15
- Public CVEs
- 24
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
15 assets you may test, 6 excluded.
Web 1
- https://sylius.com
Products and areas 14
- Admin user impersonation, the fixtures loader and the installer
- Authentication and session handling on both the shop and the admin firewalls
- Customer accounts, the address book, order history and the credentials attached to them
- Payment method configuration and the gateway integration layer, including every callback or notification route a provider uses to report a payment
- Product, taxon and attribute administration, plus image and file uploads
- Promotions, coupons and the promotion rule and action configuration behind them
- The admin panel and the Symfony security voters that authorise each admin action
- The API, built on API Platform, including every exposed resource, operation and serialization group
- The channel model, where one installation serves several storefronts with separate pricing, locales and currencies
- The order processing pipeline: unit pricing, promotion application, shipping cost calculation and tax resolution
- The policy takes private reports at a dedicated security address on maintained Sylius versions and links its release and support process rather than carving out components. The whole framework is in scope
- The resource bundle's generic CRUD routes, which expose create, read, update and delete over configured resources
- The shop front end: catalogue, cart, the checkout state machine and the customer account area
- The Twig template and theme layer, and anywhere merchant-editable content is rendered
Out of scope (6)
- Branches outside the maintained set the release policy defines
- Deployment and hosting configuration choices
- Merchant customisations, overrides and bespoke bundles written on top of Sylius, which are the merchant's own application
- Payment gateway providers' own systems, which are separate estates
- Symfony and other upstream dependency issues, unless Sylius's own use of the component is what makes the defect reachable
- Third-party Sylius plugins maintained outside the core repository
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Report privately to the address on the policy page . GitHub private vulnerability reporting is not enabled on Sylius/Sylius, so email is the only private channel
-
Check the published release and support policy first; only maintained branches receive a fix
-
Give the Sylius version and the Symfony version.
-
Because deployments customise heavily, state whether the defect exists in stock Sylius or only with a common customisation applied.
-
Name the API Platform operation and the serialization groups involved if the finding is on the API
-
Hold the detail well past the tagged release
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 35 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-31821 | Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue can add arbitrary items to another customer's cart. The endpoint returns the full cart representation | Medium 6.9 | 10 Mar 2026 |
| CVE-2026-31822 | Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any HTML or JavaScript in that value to be parsed and | Medium 5.3 | 10 Mar 2026 |
| CVE-2026-31823 | Sylius is an Open Source eCommerce Framework on Symfony. An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple places across the shop frontend and admin panel due to unsanitized entity names being rendered as raw HTML. Shop breadcrumbs (shared/breadcrumbs.html.twig): The breadcrumbs macro uses the Twig |raw filter on label values. Since taxon names, product names, and | Medium 4.8 | 10 Mar 2026 |
| CVE-2026-31824 | Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit (the global used counter on Promotion entities), coupon usage limit (the global used counter on PromotionCoupon entities), and coupon per-customer usage limit (the p | High 8.2 | 10 Mar 2026 |
| CVE-2026-31825 | Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above. | Medium 5.3 | 10 Mar 2026 |
| CVE-2026-31819 | Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's si | Medium 6.9 | 10 Mar 2026 |
| CVE-2026-31820 | Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that accepts a resource ID via #[LiveArg] and loads it wi | High 7.1 | 10 Mar 2026 |
| CVE-2024-57610 | A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to us | High 7.5 | 6 Feb 2025 |
| CVE-2021-3841 | sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser. | Medium 5.4 | 15 Nov 2024 |
| CVE-2024-29376 | Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. | Medium 6.4 | 22 Apr 2024 |
| CVE-2022-24752 | SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sy | Critical 9.8 | 15 Mar 2022 |
| CVE-2022-24749 | Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is | Medium 6.1 | 14 Mar 2022 |
| CVE-2022-24743 | Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\Comman | High 7.1 | 14 Mar 2022 |
| CVE-2022-24742 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache pol | Medium 5.0 | 14 Mar 2022 |
| CVE-2022-24733 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and | Medium 6.1 | 14 Mar 2022 |
| CVE-2021-41120 | sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled "credit card holder" field with the Customer's first and last name and hence this can lead to | High 7.5 | 5 Oct 2021 |
| CVE-2021-32720 | Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data | Medium 5.3 | 28 Jun 2021 |
| CVE-2020-15245 | In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patc | Medium 4.3 | 19 Oct 2020 |
| CVE-2020-15143 | In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 an | High 7.7 | 20 Aug 2020 |
| CVE-2020-15146 | In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and | Critical 9.6 | 20 Aug 2020 |
| CVE-2020-5218 | Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even if | Medium 4.4 | 27 Jan 2020 |
| CVE-2020-5220 | Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >= | Medium 4.4 | 27 Jan 2020 |
| CVE-2019-12186 | An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perfor | Medium 4.8 | 31 Dec 2019 |
| CVE-2019-16768 | In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when | Low 3.5 | 5 Dec 2019 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 10 Last 12 months 21 Lifetime Access control 38 % Info disclosure 24 % Business logic 22 % XSS/CSRF 16 % Latest advisories Loading the feed Overview Sylius is one of the two serious Symfony commerce frameworks, adopted by mid-market European retailers who build a bespoke shop on top of it rather than configuring a finished product. That makes nearly every deployment a fork in practice, so a framework defect propagates into codebases the maintainers cannot patch and each merchant has to merge the fix themselves. Ten of its twenty-one published advisories landed in the last twelve months. Intake is a single email address with no GitHub private reporting enabled, the project has no reward tier at any severity, and sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy takes private reports at a dedicated security address on maintained Sylius versions and links its release and support process rather than carving out components. The whole framework is in scope The shop front end: catalogue, cart, the checkout state machine and the customer account area The admin panel and the Symfony security voters that authorise each admin action The API, built on API Platform, including every exposed resource, operation and serialization group The order processing pipeline: unit pricing, promotion application, shipping cost calculation and tax resolution Promotions, coupons and the promotion rule and action configuration behind them Payment method configuration and the gateway integration layer, including every callback or notification route a provider uses to report a payment Customer accounts, the address book, order history and the credentials attached to them The channel model, where one installation serves several storefronts with separate pricing, locales and currencies Product, taxon and attribute administration, plus image and file uploads The Twig template and theme layer, and anywhere merchant-editable content is rendered The resource bundle's generic CRUD routes, which expose create, read, update and delete over configured resources Admin user impersonation, the fixtures loader and the installer Authentication and session handling on both the shop and the admin firewalls Out of scope Merchant customisations, overrides and bespoke bundles written on top of Sylius, which are the merchant's own application Third-party Sylius plugins maintained outside the core repository Symfony and other upstream dependency issues, unless Sylius's own use of the component is what makes the defect reachable Payment gateway providers' own systems, which are separate estates Branches outside the maintained set the release policy defines Deployment and hosting configuration choices Most-valued findings API Platform serialization groups exposing fields or whole resources to a role that should not see them. This is the sharpest class on the product because a single group misconfiguration leaks across every response that resource appears in Generic resource routes reachable without the voter the operation assumes, the quickest way from an anonymous shop session to admin-side data Checkout state machine transitions that reach a completed order without a valid payment Promotion and coupon rules that drive a total below what the goods are worth, including stacking and reapplication Payment gateway callback forgery that marks an order paid without a genuine provider response Cross-channel access, where a request scoped to one channel reads or writes another channel's pricing, orders or customers Admin impersonation reachable by a non-admin, which hands over the whole back office in one step Insecure direct object references on customer orders, addresses and invoices, the plainest personal-data leak on a shop Twig template injection anywhere merchant-editable content is rendered server-side Authentication and session defects across the two firewalls, including a shop session that carries into the admin one Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] . GitHub private vulnerability reporting is not enabled on Sylius/Sylius, so email is the only private channel Check the published release and support policy first; only maintained branches receive a fix Give the Sylius version and the Symfony version. The framework underneath changes behaviour between majors and a finding can depend on which one is in play Because deployments customise heavily, state whether the defect exists in stock Sylius or only with a common customisation applied. Stock findings are the ones the maintainers can act on Name the API Platform operation and the serialization groups involved if the finding is on the API, since that is where the product's authorisation most often turns There is no reward tier and no payment to negotiate Disclosure Coordinated privately by email with the core team and published as a GitHub Security Advisory alongside patched releases across the maintained branches. The project publishes a release and support policy that decides which branches get a backport. No fixed embargo length is stated. Hold the detail well past the tagged release, because merchants running a customised fork of Sylius merge a security fix on their own schedule and often a long way behind upstream. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability