CVE-2026-48013

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1

Description Authenticated admin users can perform Server-Side Request Forgery (SSRF) via the '/api/ action/media/external-link' endpoint. The issue stems from an inconsistency in the MediaUploadService where the linkURL flow only validates the URL format using a regular expression for 'http://' or 'https://' prefixes, failing to check if the target IP belongs to private or reserved ranges. This allows attackers to make server-side HTTP HEAD requests to internal network services and cloud metadata endpoints, such as '169.254.169.254'. Consequently, an attacker can probe cloud metadata, scan internal networks to identify open ports, and leak internal service information through the content-length header. The vulnerability is further exacerbated by the Symfony HttpClient following redirects by default, which can be used to bypass initial checks.

Recommendations Update Shopware to version 6.6.10.18. Update Shopware to version 6.7.10.1. As a temporary mitigation, restrict access to the '/api/ action/media/external-link' endpoint for administrative users who do not require this functionality.