Junglewise Threat Intelligence

CVE-2026-48015: Shopware stored XSS via unsanitized SVG file upload

CVE-2026-48015 · Severity: medium · CVSS 4.9 · Published 2026-07-17

Technologies: Shopware. Vendors: Shopware.

Executive brief

Shopware is an open-source e-commerce platform used to build and manage online stores. A security vulnerability allowed users with media upload permissions to upload malicious SVG image files containing hidden JavaScript code. If an administrator or customer views these images, the malicious code could execute in their browser, potentially leading to unauthorized access to sensitive data or session hijacking.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Shopware's media management subsystem due to a lack of SVG content sanitization. While SVG files were included in the 'allowed_extensions' whitelist, the upload pipeline (MediaUploadController to FileSaver) failed to strip active content. An attacker with high privileges (media upload permissions) can upload SVGs containing 'onload', '<script>', or '<foreignObject>' tags. When these files are served and viewed in a browser, the embedded JavaScript executes within the context of the Shopware domain. The fix introduces a 'FileContentValidationStrategy' and 'SvgContentValidator' that enforces a strict passive allowlist for SVG elements and attributes.

Affected products

  • Shopware shopware/shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
  • Shopware shopware/platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

Timeline

  • 2026-05-04: patched: Initial fix commit for version 6.7.x
  • 2026-05-18: patched: Backport fix commit for version 6.6.x
  • 2026-07-17: disclosed: CVE published to NVD

References

Related threats