I'm using the Magento 2.1.6 and I want to apply the patch CE-MAGETWO-67805.patch.

How can I apply the *.patch files?

  • can you please help me on how to find the required patches to install for a given Magento version. Is there any tool you are using to find them? or we should visit magento.com for patches information? Feb 8, 2018 at 14:13
  • i was searching for best practice to apply these patches on a Magento 2 Composer installation. In this Artikel i posted how we Patch Magento Source. medium.com/@LarsRoettig/… Aug 7, 2018 at 18:08

5 Answers 5



On Magento Cloud you just need to add the patch inside your m2-hotfixes folder.

You can use the traditional method:

git apply MAGEPatch-20181106.patch


patch -p1 < MDVA-14172_EE_2.2.6_COMPOSER_v1.patch    


Or to solve the same situation with files being patched in the vendor directory, there is a good article on it here: http://jamescowie.me/blog/2016/12/Composer-Magento-Patches/

We did something similar in our composer file:

   "extra": {
        "magento-force": "override",
        "composer-exit-on-patch-failure": true,
        "patches": {
            "magento/module-cache-invalidate": {
                "GH 8815: Varnish purge requests can overrun size limit": "patches/composer/github-issue-8815.patch"

In our Magento root, we have a patches/composer directory which is where we reference them and in the extras/patches section, we tell it which Magento module to patch.

Ironically I found this post when looking at how this was done only to find our solution was already in place by our initial vendor.


If you have git installed on your environment just use the following copy the patch on you magento root folder.

Then use:

$ git apply MAGETWO-67805-2017-05-17-03-04-03.patch
  • 1
    what if one doesn't keep vendor folder as part of the git repository? Doesn't this just patch core files directly?
    – dchayka
    Sep 8, 2017 at 19:16
  • @dchayka you need to include patch in composer.json Dec 1, 2022 at 8:48
  • Thank you @GigaTodadze , I've been taking that approach.
    – dchayka
    Dec 1, 2022 at 17:10

If anyone is doing this via Composer there is a free module you can install it allows you to install patches from the cli.

magento@ce87c6cc1cdf /home/magento/htdocs/$ php bin/magento patch:list
Magento Version: 2.3.0
PRODSECBUG-2198 - This patch provides protection against the SQL injection vulnerability described under PRODSECBUG-2198
More info can be found here: https://www.magentocommerce.com/products/downloads/magento/#download2288

magento@ce87c6cc1cdf /home/magento/htdocs/$ php bin/magento patch:add --patch=PRODSECBUG-2198
Patch: PRODSECBUG-2198
Message: PRODSECBUG-2198 - Added via Zero1_Patches
Magento Version: 2.3.0
The patch has been added to you composer.json
You can now run: "composer install" to apply the patch.
magento@ce87c6cc1cdf /home/magento/htdocs/$

I use it on Mdoq, but it can be used anywhere.
There is a good blog post on it here

  • I tried to email the company about adding patches but their email is broken ([email protected]). It also looks like they have not added new patches for about a year. This seems to be a dead project.
    – njm5785
    Mar 4, 2020 at 18:40
  • @njm5785 not a dead project, apologies we missed your email. How can I help?
    – Adam
    Apr 17, 2020 at 10:06
  1. Ensure that your Magento store is in developer mode

    php bin/magento deploy:mode:set developer

  2. Download the security patch

    git apply MAGETWO-67805-2017-05-17-03-04-03.patch

  3. After that just run below command to apply the patch

    php bin/magento setup:upgrade

  • Have you any idea, how to remove last apply the patch? Mar 15, 2019 at 11:12
  • Download the patch file and place it into the root directory of Magento

  • Set the developer mode by using command:

    php bin/magento deploy:mode:set developer

  • Apply the patch by using command:

    $ git apply CE-MAGETWO-93036-2018-07-02-07-06-53.patch

  • The possible warnings and errors you can get are:

warning: vendor/magento/module-email/Model/FileName.php has type 100755, expected 100644

The above warning means that the permissions of the FileName.php are 755 though the expected permissions are 644.

If you apply the patch file twice you are expected to get an error message similar to:

error: patch failed: vendor/magento/module-email/Model/AbstractTemplate.php:534

error: vendor/magento/module-email/Model/AbstractTemplate.php: patch does not apply

Its ok to get the above error or warning.

Your patch is still successfully applied. Enjoy ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.