# CVE-2026-48015: Shopware stored XSS via unsanitized SVG file upload

Source: https://junglewise.ai/threats/cve-2026-48015-shopware-stored-xss-via-unsanitized-svg-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-48015 · Severity: medium · CVSS 4.9 · Published 2026-07-17

Shopware is an open-source e-commerce platform used to build and manage online stores. A security vulnerability allowed users with media upload permissions to upload malicious SVG image files containing hidden JavaScript code. If an administrator or customer views these images, the malicious code could execute in their browser, potentially leading to unauthorized access to sensitive data or session hijacking.

Technologies: [shopware/core (Packagist)](https://junglewise.ai/threats/technologies/shopware-core), [shopware/platform (Packagist)](https://junglewise.ai/threats/technologies/shopware-platform), [Shopware](https://junglewise.ai/threats/technologies/shopware). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Shopware](https://junglewise.ai/threats/vendors/shopware).

## Quick answers

**Is CVE-2026-48015 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48015 being exploited in the wild.

**How severe is CVE-2026-48015?** Medium severity, with a CVSS score of 4.9, published 17 July 2026.

**Which products and versions are affected?** shopware/core (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; shopware/platform (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; Shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1.

**Is there a fix for CVE-2026-48015?** Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48015 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48015?** Check whether you run shopware/core (Packagist), shopware/platform (Packagist) or Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shopware/core (Packagist): upgrade to 6.7.10.1 or later

  ```sh
  composer require shopware/core:^6.7.10.1
  ```

- shopware/platform (Packagist): upgrade to 6.7.10.1 or later

  ```sh
  composer require shopware/platform:^6.7.10.1
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Shopware's media management subsystem due to a lack of SVG content sanitization. While SVG files were included in the 'allowed_extensions' whitelist, the upload pipeline (MediaUploadController to FileSaver) failed to strip active content. An attacker with high privileges (media upload permissions) can upload SVGs containing 'onload', '<script>', or '<foreignObject>' tags. When these files are served and viewed in a browser, the embedded JavaScript executes within the context of the Shopware domain. The fix introduces a 'FileContentValidationStrategy' and 'SvgContentValidator' that enforces a strict passive allowlist for SVG elements and attributes.

## Affected products

- Shopware shopware/shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
- Shopware shopware/platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

## Identifiers

- CVE-2026-48015
- GHSA-xvhc-gm7j-mhmc

## Timeline

- 2026-05-04: patched: Initial fix commit for version 6.7.x
- 2026-05-18: patched: Backport fix commit for version 6.6.x
- 2026-07-17: disclosed: CVE published to NVD

## References

- [https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497](https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497)
- [https://github.com/shopware/shopware/commit/fd6d39bdb62dfa06fe62c7c87b37607d84094cda](https://github.com/shopware/shopware/commit/fd6d39bdb62dfa06fe62c7c87b37607d84094cda)
- [https://github.com/shopware/shopware/releases/tag/v6.6.10.18](https://github.com/shopware/shopware/releases/tag/v6.6.10.18)
- [https://github.com/shopware/shopware/releases/tag/v6.7.10.1](https://github.com/shopware/shopware/releases/tag/v6.7.10.1)
- [https://github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc](https://github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc)

## Related threats

- [Shopware stored XSS in media upload via missing security headers](https://junglewise.ai/threats/cve-2026-104937-shopware-version-6-7-allows-the-upload-of-attacker-controlled)
- [Shopware SSRF in Media External-Link endpoint](https://junglewise.ai/threats/cve-2026-48013-shopware-ssrf-in-media-external-link-endpoint)
- [Shopware open redirect in SSO entry point via Referer header](https://junglewise.ai/threats/cve-2026-48012-shopware-open-redirect-in-sso-entry-point-via-referer-header)
- [Shopware authorization bypass in handle-payment API](https://junglewise.ai/threats/cve-2026-48016-shopware-authorization-bypass-in-handle-payment-api)
- [Shopware Admin API authorization bypass in order state transitions](https://junglewise.ai/threats/cve-2026-48014-shopware-admin-api-authorization-bypass-in-order-state)