| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-10-22 | 985 Bytes | |
| v2.1.17 source code.tar.gz | 2026-10-22 | 24.8 MB | |
| v2.1.17 source code.zip | 2026-10-22 | 30.7 MB | |
| Totals: 3 Items | 55.5 MB | 0 | |
TL;DR
đź”’ This is a security release!
Fixes the following vulnerabilities:
- Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data
- A disabled API stays reachable through a percent-encoded path
- Host header injection in the shop password reset e-mail link when the channel has no hostname
- Unpublished product reviews disclosed through the Shop API item endpoint
- Channel-based payment method restriction bypass on shop payment request API endpoint
Full Changelog: https://github.com/Sylius/Sylius/compare/v2.1.16...v2.1.17