Download Latest Version
v2.2.8 source code.zip (30.8 MB)
Get an email when there's a new version of Sylius
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-06-02 | 1.1 kB | |
| v2.0.18 source code.tar.gz | 2026-06-02 | 24.2 MB | |
| v2.0.18 source code.zip | 2026-06-02 | 30.0 MB | |
| Totals: 3 Items | 54.2 MB | 0 | |
TL;DR
🔒 This is a security release!
Fixes the following vulnerabilities:
- IDOR on Shop Payment Request endpoints in API
- Channel-based payment method restriction bypass on shop account orders API endpoint
- Cart FormComponent allows modification or deletion of an already-completed order
Details
- #19035 [2.0] Check payment request ownership (@TheMilek)
- #19036 [2.0] Prevent stale cart LiveComponents from mutating completed orders (@TheMilek)
- #19037 [2.0][API] Enforce channel eligibility check when changing payment method via account endpoint (@TheMilek)
Full Changelog: https://github.com/Sylius/Sylius/compare/v2.0.17...v2.0.18