Shopware 6.7.13.1 Security Update: Adapting to the `template_from_string` Removal

Shopware 6.7.13.1 Security Update: Adapting to the `template_from_string` Removal

A recent discussion in the Shopware forum highlights a critical change introduced with Shopware version 6.7.13.1: the apparent removal or unavailability of the template_from_string Twig function. This change, while potentially disruptive for some custom implementations, stems from important security considerations.

The Initial Challenge: Missing Functionality

The thread began with user klogges reporting that template_from_string was no longer accessible in Shopware 6.7.13.1. This posed a problem for their setup, where they had been dynamically rendering Twig snippets stored within product descriptions and custom fields. For instance, they used constructs like this in their templates:

{{ "customFields.product_important_infos" | trans | raw }}

These dynamic Twig expressions were then processed using include(template_from_string(...)) to display translated and formatted content directly within the storefront. The immediate question was whether this function had been removed for security reasons.

The Security Revelation: CVE-2026-46634

The answer quickly came from user Max_Shop, who provided a crucial link to a Symfony blog post detailing CVE-2026-46634. This vulnerability revealed that the template_from_string() function could escape a SourcePolicy-driven sandbox via a synthesized template name. In simpler terms, it presented a potential Server-Side Template Injection (SSTI) loophole, allowing malicious code to be executed if untrusted input was rendered directly via this function.

Shopware, being built on Symfony components, naturally inherits such security advisories. The removal or restriction of template_from_string in Shopware 6.7.13.1 is a direct response to this critical vulnerability, aiming to protect stores from potential exploits.

The Solution: Custom Twig Functions for Secure Rendering

Understanding the security implications, klogges swiftly adapted their implementation. They replaced the problematic include(template_from_string(...)) calls in their theme with a custom Twig function. This new custom function is designed to:

• Validate the input to ensure it originates from legitimate custom fields.
• Utilize the TranslatorInterface to safely translate the content.
• Output the content securely, without directly exposing the system to SSTI risks.

As klogges stated: "Ich habe die include(template_from_string( Funktionen in unserem Theme gegen eine Custom-Twig-Funktion ersetzt, die nur bei validen customFields diese mit dem TranslatorInterface übersetzt und ausgibt. Somit keine SSTI-Lücke mehr." (I replaced the include(template_from_string( functions in our theme with a Custom-Twig-function that only translates and outputs valid customFields with the TranslatorInterface. Thus, no more SSTI vulnerability.)

Key Takeaways for Shopware Developers and Merchants

This forum discussion serves as an excellent case study for several reasons:

• Prioritize Security Updates: It underscores the importance of staying current with Shopware versions and understanding the underlying reasons for core framework changes, especially those related to security.
• Beware of Dynamic Twig Rendering: Directly rendering user-supplied or database-stored Twig code via functions like template_from_string is inherently risky. Developers should always assume such input can be malicious.
• Implement Secure Alternatives: When dynamic content rendering is necessary, developers should create custom, secure solutions. This often involves:
  • Strict input validation and sanitization.
  • Using Shopware's built-in services (like TranslatorInterface) for processing.
  • Creating custom Twig extensions or functions that control what can be rendered and how, preventing arbitrary code execution.

The proactive approach taken by Shopware to address the Symfony CVE, and the community's quick adaptation, highlights the robust security posture and problem-solving capabilities within the Shopware ecosystem. Developers should review their custom themes and plugins for any reliance on template_from_string and implement similar secure alternatives.