CVE-2026-48015 Details
Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, <script>, and <foreignObject> to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
A stored cross-site scripting vulnerability has been identified in Shopware versions prior to 6.6.10.18 and 6.7.10.1. The issue arises from SVG files being included in the allowed extensions whitelist, allowing any admin user to upload them through the media manager. However, there is no sanitization of SVG content during the upload process. As a result, malicious SVGs containing JavaScript, such as event handlers and certain tags, can execute when the uploaded file is viewed within the Shopware domain.
Shopware has released patches for this vulnerability in versions 6.6.10.18 and 6.7.10.1. Users should update to these versions. Additionally, for future uploads, SVG content can be validated against a strict allowlist to block active elements and references.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497 | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/commit/fd6d39bdb62dfa06fe62c7c87b37607d84094cda | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/releases/tag/v6.6.10.18 | [email protected] | Release NotesVendor |
| https://github.com/shopware/shopware/releases/tag/v6.7.10.1 | [email protected] | Release NotesVendor |
| https://github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopware | >= 6.7.0.0, < 6.7.10.1 < 6.6.10.18 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |