---
id: CVE-2026-53637
title: Sylius is an Open Source eCommerce Framework on Symfony
summary: >-
  Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0
  through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an
  improper workflow enforcement vulnerability in the cart `FormComponent`. When
  an order is co…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-672
  - CWE-841
vendor: Sylius
product: Sylius
affected:
  - 'Sylius >= 2.0.0, < 2.0.18'
  - 'Sylius >= 2.1.0, < 2.1.15'
  - 'Sylius >= 2.2.0, < 2.2.6'
patched:
  - sylius/sylius 2.0.18
  - sylius/sylius 2.1.15
  - sylius/sylius 2.2.6
published: '2026-09-08'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:04:42.813'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53637'
references:
  - url: 'https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-5597-7rmh-97q5'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
epss: 0.00295
epssPercentile: 0.22304
aliases:
  - GHSA-5597-7rmh-97q5
ecosystem: composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T15:37:14.854087Z'
ingestedAt: '2026-07-09T21:52:34.654Z'
---

## Overview

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53637)

Affected packages:

- `sylius/sylius >= 2.0.0, < 2.0.18`
- `sylius/sylius >= 2.1.0, < 2.1.15`
- `sylius/sylius >= 2.2.0, < 2.2.6`

Patched in:

- `sylius/sylius 2.0.18`
- `sylius/sylius 2.1.15`
- `sylius/sylius 2.2.6`

Source: https://github.com/advisories/GHSA-5597-7rmh-97q5