CVE-2026-48015: Shopware stored XSS via unsanitized SVG file upload

CVE-2026-48015 · Severity: medium · CVSS 4.9 · Published 2026-07-17

Shopware is an open-source e-commerce platform used to build and manage online stores. A security vulnerability allowed users with media upload permissions to upload malicious SVG image files containing hidden JavaScript code. If an administrator or customer views these images, the malicious code could execute in their browser, potentially leading to unauthorized access to sensitive data or session hijacking.

Technologies: shopware/core (Packagist), shopware/platform (Packagist), Shopware. Vendors: Packagist, Shopware.

Quick answers

Is CVE-2026-48015 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48015 being exploited in the wild.
How severe is CVE-2026-48015?
Medium severity, with a CVSS score of 4.9, published 17 July 2026.
Which products and versions are affected?
shopware/core (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; shopware/platform (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; Shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1.
Is there a fix for CVE-2026-48015?
Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48015 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48015?
Check whether you run shopware/core (Packagist), shopware/platform (Packagist) or Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shopware/core (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/core:^6.7.10.1
  • shopware/platform (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/platform:^6.7.10.1

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Shopware's media management subsystem due to a lack of SVG content sanitization. While SVG files were included in the 'allowed_extensions' whitelist, the upload pipeline (MediaUploadController to FileSaver) failed to strip active content. An attacker with high privileges (media upload permissions) can upload SVGs containing 'onload', '<script>', or '<foreignObject>' tags. When these files are served and viewed in a browser, the embedded JavaScript executes within the context of the Shopware domain. The fix introduces a 'FileContentValidationStrategy' and 'SvgContentValidator' that enforces a strict passive allowlist for SVG elements and attributes.

Affected products

  • Shopware shopware/shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
  • Shopware shopware/platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

Identifiers

  • CVE-2026-48015
  • GHSA-xvhc-gm7j-mhmc

Timeline

  • 2026-05-04: patched: Initial fix commit for version 6.7.x
  • 2026-05-18: patched: Backport fix commit for version 6.6.x
  • 2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.