CVE-2026-48015

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1

Description SVG files are included in the allowed extensions whitelist within src/Core/Framework/Resources/config/packages/shopware.yaml, allowing them to be uploaded via the media manager. The upload pipeline, which flows from MediaUploadController to FileSaver and then to TypeDetector, lacks content sanitization for SVG files. This allows an attacker to upload malicious SVG files containing JavaScript—such as onload, <script>, and <foreignObject>—which executes within the Shopware domain when the file is viewed. This results in stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and served to other users, potentially leading to admin account takeover or customer data theft.

Recommendations Update to version 6.6.10.18. Update to version 6.7.10.1. As a temporary mitigation, remove svg from the allowed extensions list in src/Core/Framework/Resources/config/packages/shopware.yaml to prevent SVG uploads.