Medium

Improper Restriction of Rendered UI Layers or Frames in Sylius

Disclosed: 14.03.2022
Updated: 11.10.2026 10:22

Impact

It is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker

Patches

The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2, and above.

Workarounds

Every response from app should have an X-Frame-Options header set to: sameorigin. To achieve that you just need to add a new subscriber in your app.

php

<?php

// src/EventListener/XFrameOptionsSubscriber.php

namespace App\EventListener

final class XFrameOptionsSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::RESPONSE => 'onKernelResponse',
        ];
    }

    public function onKernelResponse(ResponseEvent $event): void
    {
        if (!$this->isMainRequest($event)) {
            return;
        }

        $response = $event->getResponse();

        $response->headers->set('X-Frame-Options', 'sameorigin');
    }

    private function isMainRequest(ResponseEvent $event): bool
    {
        if (\method_exists($event, 'isMainRequest')) {
            return $event->isMainRequest();
        }

        return $event->isMasterRequest();
    }
}

And register it in the container:

yaml

# config/services.yaml
services:
    # ...
    App\EventListener\XFrameOptionsSubscriber:
        tags: ['kernel.event_subscriber']

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	sylius/sylius	< 1.9.10, >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.2	1.9.10, 1.10.11, 1.11.2

References

CVSS score 6.1/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-1021
Platform: Composer
Package: sylius/sylius
Disclosed: 14.03.2022
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4jp3-q2qm-9fmw - CC BY 4.0

Vulnerability history: sylius/sylius

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive

Total entries: 23
First → latest: 12.2019 07.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 4
Medium 17
Low 2

Disclosures per year

2019: 1
2020: 3
2021: 1
2022: 4
2023: 0
2024: 4
2025: 0
2026: 10

11.03.2026

Sylius has a Promotion Usage Limit Bypass via Race Condition

High · 8.2 CVE-2026-31824 < 1.9.12, >= 1.10.0, < 1.10.16, >= 1.11.0, < 1.11.17, >= 1.12.0, < 1.12.23, >= 1.13.0, < 1.13.15, >= 1.14.0, < 1.14.18, >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3
11.03.2026

Sylius affected by IDOR in Cart and Checkout LiveComponents

High CVE-2026-31820 >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 2.0.16, 2.1.12, 2.2.3
17.07.2024

Sylius has a security vulnerability via adjustments API endpoint

High · 7.5 CVE-2024-40633 >= 1.12.0-alpha.1, < 1.12.19, >= 1.13.0-alpha.1, < 1.13.4, < 1.9.12, >= 1.10.0-alpha.1, < 1.10.16, >= 1.11.0-alpha.1, < 1.11.17 1.12.19, 1.13.4, 1.9.12, 1.10.16, 1.11.17
14.03.2022

Insufficient Session Expiration in Sylius

High · 7.1 CVE-2022-24743 >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.2 1.10.11, 1.11.2
14.03.2022

Improper Restriction of Rendered UI Layers or Frames in Sylius this entry

Medium · 6.1 CVE-2022-24733 < 1.9.10, >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.2 1.9.10, 1.10.11, 1.11.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application