# CVE-2026-48013: Shopware SSRF in Media External-Link endpoint

Source: https://junglewise.ai/threats/cve-2026-48013-shopware-ssrf-in-media-external-link-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-48013 · Severity: medium · CVSS 4.1 · Published 2026-07-23

Shopware, an open-source e-commerce platform, contains a security flaw in how it handles external links within its media management system. An authorized administrator could exploit this to force the server to send requests to internal network addresses or cloud metadata services that are normally hidden from the internet. This could allow an attacker to perform internal network reconnaissance or leak sensitive information about the server's hosting environment.

Technologies: [shopware/core (Packagist)](https://junglewise.ai/threats/technologies/shopware-core), [shopware/platform (Packagist)](https://junglewise.ai/threats/technologies/shopware-platform), [Shopware](https://junglewise.ai/threats/technologies/shopware). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Shopware](https://junglewise.ai/threats/vendors/shopware).

## Quick answers

**Is CVE-2026-48013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48013 being exploited in the wild.

**How severe is CVE-2026-48013?** Medium severity, with a CVSS score of 4.1, published 23 July 2026.

**Which products and versions are affected?** shopware/core (Packagist) >= 6.7.0.0, < 6.7.10.1, ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; shopware/platform (Packagist) >= 6.7.0.0, < 6.7.10.1, ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; Shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1.

**Is there a fix for CVE-2026-48013?** Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48013 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48013?** Check whether you run shopware/core (Packagist), shopware/platform (Packagist) or Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shopware/core (Packagist): upgrade to 6.7.10.1 or later

  ```sh
  composer require shopware/core:^6.7.10.1
  ```

- shopware/platform (Packagist): upgrade to 6.7.10.1 or later

  ```sh
  composer require shopware/platform:^6.7.10.1
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Shopware MediaUploadService due to inconsistent URL validation between different upload flows. The `/api/_action/media/external-link` endpoint uses the `linkURL()` method, which only performs a basic regex check for the protocol prefix instead of validating the destination IP against private or reserved ranges. An authenticated attacker with administrative privileges can trigger HTTP HEAD requests to internal IP addresses (e.g., 10.x.x.x, 127.0.0.1) or cloud metadata endpoints (169.254.169.254). This allows for internal port scanning and information disclosure via the `content-length` header, which is stored in the database as the file size. The vulnerability is mitigated by the requirement for high privileges (Admin) and is patched in versions 6.6.10.18 and 6.7.10.1.

## Affected products

- Shopware Shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
- Shopware Platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

## Identifiers

- CVE-2026-48013
- GHSA-gq96-5pfx-f4vc

## Timeline

- 2026-05-19: patched: Security releases 6.6.10.18 and 6.7.10.1 published
- 2026-05-19: advisory: GitHub Security Advisory GHSA-gq96-5pfx-f4vc published
- 2026-07-23: disclosed: CVE-2026-48013 published to NVD

## References

- [https://github.com/shopware/shopware/releases/tag/v6.6.10.18](https://github.com/shopware/shopware/releases/tag/v6.6.10.18)
- [https://github.com/shopware/shopware/releases/tag/v6.7.10.1](https://github.com/shopware/shopware/releases/tag/v6.7.10.1)
- [https://github.com/shopware/shopware/security/advisories/GHSA-gq96-5pfx-f4vc](https://github.com/shopware/shopware/security/advisories/GHSA-gq96-5pfx-f4vc)

## Related threats

- [Shopware stored XSS in media upload via missing security headers](https://junglewise.ai/threats/cve-2026-104937-shopware-version-6-7-allows-the-upload-of-attacker-controlled)
- [Shopware open redirect in SSO entry point via Referer header](https://junglewise.ai/threats/cve-2026-48012-shopware-open-redirect-in-sso-entry-point-via-referer-header)
- [Shopware authorization bypass in handle-payment API](https://junglewise.ai/threats/cve-2026-48016-shopware-authorization-bypass-in-handle-payment-api)
- [Shopware stored XSS via unsanitized SVG file upload](https://junglewise.ai/threats/cve-2026-48015-shopware-stored-xss-via-unsanitized-svg-file-upload)
- [Shopware Admin API authorization bypass in order state transitions](https://junglewise.ai/threats/cve-2026-48014-shopware-admin-api-authorization-bypass-in-order-state)