Sylius allows an attacker to redirect users to malicious sites via the HTTP Referer header in specific controller actions. The vulnerability lets an attacker deliver a link that looks legitimate, cause the browser to send the attacker's domain as the Referer, and then the shop redirects the user back to that malicious site. This can be exploited to harvest credentials or frame phishing pages, since the redirect originates from a trusted domain and does not require additional privileges.

Sylius eCommerce Framework on Symfony is affected. Vulnerable versions are those prior to 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, and 2.2.3. Any installation of Sylius before these releases is impacted.

The CVSS score of 6.9 indicates a moderate severity. Exploitation requires the victim to click a genuine looking link from an attacker-controlled page, which is trivial for public endpoints and moderately trivial for admin‑only endpoints if an authenticated admin follows an external link. The EPSS score is below 1 %, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog.