{"id":"CVE-2026-48015","aliases":["EUVD-2026-45238","GHSA-xvhc-gm7j-mhmc"],"status":"published","title":"Shopware: Stored XSS via SVG file upload — no SVG sanitization","description":"Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, \u003cscript\u003e, and \u003cforeignObject\u003e to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00485,"percentile":0.4222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-06-04T19:35:26Z","modified":"2026-11-04T02:48:05Z","fixes":[{"ecosystem":"Packagist","package":"shopware/core","fixed_in":["6.7.10.1","6.6.10.18"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"shopware/platform","fixed_in":["6.7.10.1","6.6.10.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.10.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.10.18"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.10.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.10.18"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.10.1"}]}],"versions":["v6.7.0.0","v6.7.0.1","v6.7.1.0","v6.7.1.1","v6.7.1.2","v6.7.10.0","v6.7.2.0","v6.7.2.1","v6.7.2.2","v6.7.3.0","v6.7.3.1","v6.7.4.0","v6.7.4.1","v6.7.4.2","v6.7.5.0","v6.7.5.1","v6.7.6.0","v6.7.6.1","v6.7.6.2","v6.7.7.0","v6.7.7.1","v6.7.8.0","v6.7.8.1","v6.7.8.2","v6.7.9.0","v6.7.9.1"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.10.18"}]}],"versions":["6.3.0.0","6.3.0.1","6.3.0.2","6.3.1.0","6.3.1.1","6.3.2.0","6.3.2.1","6.3.3.0","6.3.3.1","6.3.4.0","6.3.4.1","6.3.5.0","6.3.5.1","6.3.5.2","6.3.5.3","6.3.5.4","6.4.0.0","6.4.0.0-RC1","6.4.1.0","6.4.1.1","6.4.1.2","6.4.10.0","6.4.10.1","6.4.11.0","6.4.11.1","6.4.12.0","6.4.13.0","6.4.14.0","6.4.15.0","6.4.15.1","6.4.15.2","6.4.16.0","6.4.16.1","6.4.17.0","6.4.17.1","6.4.17.2","6.4.18.0","6.4.18.1","6.4.19.0","6.4.2.0","6.4.2.1","6.4.20.0","6.4.20.1","6.4.20.2","6.4.3.0","6.4.3.1","6.4.4.0","6.4.4.1","6.4.5.0","6.4.5.1","6.4.6.0","6.4.6.1","6.4.7.0","6.4.8.0","6.4.8.1","6.4.8.2","6.4.9.0","6.5.0.0","6.5.0.0-rc1","6.5.0.0-rc2","6.5.0.0-rc3","6.5.0.0-rc4","v6.0.0+ea2","v6.1.0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.1.6","v6.2.0","v6.2.0-RC1","v6.2.1","v6.2.2","v6.2.3","v6.5.1.0","v6.5.1.1","v6.5.2.0","v6.5.2.1","v6.5.3.0","v6.5.3.1","v6.5.3.2","v6.5.3.3","v6.5.4.0","v6.5.4.1","v6.5.5.0","v6.5.5.1","v6.5.5.2","v6.5.6.0","v6.5.6.1","v6.5.7.0","v6.5.7.1","v6.5.7.2","v6.5.7.3","v6.5.7.4","v6.5.8.0","v6.5.8.1","v6.5.8.10","v6.5.8.11","v6.5.8.12","v6.5.8.13","v6.5.8.14","v6.5.8.15","v6.5.8.16","v6.5.8.17","v6.5.8.18","v6.5.8.19","v6.5.8.2","v6.5.8.3","v6.5.8.4","v6.5.8.5","v6.5.8.6","v6.5.8.7","v6.5.8.8","v6.5.8.9","v6.6.0.0","v6.6.0.0-rc1","v6.6.0.0-rc2","v6.6.0.0-rc3","v6.6.0.0-rc4","v6.6.0.0-rc5","v6.6.0.0-rc6","v6.6.0.0-rc7","v6.6.0.1","v6.6.0.2","v6.6.0.3","v6.6.1.0","v6.6.1.1","v6.6.1.2","v6.6.10.0","v6.6.10.1","v6.6.10.10","v6.6.10.11","v6.6.10.12","v6.6.10.13","v6.6.10.14","v6.6.10.15","v6.6.10.16","v6.6.10.17","v6.6.10.2","v6.6.10.3","v6.6.10.4","v6.6.10.5","v6.6.10.6","v6.6.10.7","v6.6.10.8","v6.6.10.9","v6.6.2.0","v6.6.3.0","v6.6.3.1","v6.6.4.0","v6.6.4.1","v6.6.5.0","v6.6.5.1","v6.6.6.0","v6.6.6.1","v6.6.7.0","v6.6.7.1","v6.6.8.0","v6.6.8.1","v6.6.8.2","v6.6.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0.0"},{"fixed":"6.7.10.1"}]}],"versions":["v6.7.0.0","v6.7.0.1","v6.7.1.0","v6.7.1.1","v6.7.1.2","v6.7.10.0","v6.7.2.0","v6.7.2.1","v6.7.2.2","v6.7.3.0","v6.7.3.1","v6.7.4.0","v6.7.4.1","v6.7.4.2","v6.7.5.0","v6.7.5.1","v6.7.6.0","v6.7.6.1","v6.7.6.2","v6.7.7.0","v6.7.7.1","v6.7.8.0","v6.7.8.1","v6.7.8.2","v6.7.9.0","v6.7.9.1"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.10.18"}]}],"versions":["6.3.0.0","6.3.0.1","6.3.0.2","6.3.1.0","6.3.1.1","6.3.2.0","6.3.2.1","6.3.3.0","6.3.3.1","6.3.4.0","6.3.4.1","6.3.5.0","6.3.5.1","6.3.5.2","6.3.5.3","6.3.5.4","6.4.0.0","6.4.0.0-RC1","6.4.1.0","6.4.1.1","6.4.1.2","6.4.10.0","6.4.10.1","6.4.11.0","6.4.11.1","6.4.12.0","6.4.13.0","6.4.14.0","6.4.15.0","6.4.15.1","6.4.15.2","6.4.16.0","6.4.16.1","6.4.17.0","6.4.17.1","6.4.17.2","6.4.18.0","6.4.18.1","6.4.19.0","6.4.2.0","6.4.2.1","6.4.20.0","6.4.20.1","6.4.20.2","6.4.3.0","6.4.3.1","6.4.4.0","6.4.4.1","6.4.5.0","6.4.5.1","6.4.6.0","6.4.6.1","6.4.7.0","6.4.8.0","6.4.8.1","6.4.8.2","6.4.9.0","6.5.0.0","6.5.0.0-rc1","6.5.0.0-rc2","6.5.0.0-rc3","6.5.0.0-rc4","v6.0.0+ea2","v6.1.0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.1.6","v6.2.0","v6.2.0-RC1","v6.2.1","v6.2.2","v6.2.3","v6.5.1.0","v6.5.1.1","v6.5.2.0","v6.5.2.1","v6.5.3.0","v6.5.3.1","v6.5.3.2","v6.5.3.3","v6.5.4.0","v6.5.4.1","v6.5.5.0","v6.5.5.1","v6.5.5.2","v6.5.6.0","v6.5.6.1","v6.5.7.0","v6.5.7.1","v6.5.7.2","v6.5.7.3","v6.5.7.4","v6.5.8.0","v6.5.8.1","v6.5.8.10","v6.5.8.11","v6.5.8.12","v6.5.8.13","v6.5.8.14","v6.5.8.15","v6.5.8.16","v6.5.8.17","v6.5.8.18","v6.5.8.19","v6.5.8.2","v6.5.8.3","v6.5.8.4","v6.5.8.5","v6.5.8.6","v6.5.8.7","v6.5.8.8","v6.5.8.9","v6.6.0.0","v6.6.0.0-rc1","v6.6.0.0-rc2","v6.6.0.0-rc3","v6.6.0.0-rc4","v6.6.0.0-rc5","v6.6.0.0-rc6","v6.6.0.0-rc7","v6.6.0.1","v6.6.0.2","v6.6.0.3","v6.6.1.0","v6.6.1.1","v6.6.1.2","v6.6.10.0","v6.6.10.1","v6.6.10.10","v6.6.10.11","v6.6.10.12","v6.6.10.13","v6.6.10.14","v6.6.10.15","v6.6.10.16","v6.6.10.17","v6.6.10.2","v6.6.10.3","v6.6.10.4","v6.6.10.5","v6.6.10.6","v6.6.10.7","v6.6.10.8","v6.6.10.9","v6.6.2.0","v6.6.3.0","v6.6.3.1","v6.6.4.0","v6.6.4.1","v6.6.5.0","v6.6.5.1","v6.6.6.0","v6.6.6.1","v6.6.7.0","v6.6.7.1","v6.6.8.0","v6.6.8.1","v6.6.8.2","v6.6.9.0"]}],"products":[{"vendor":"runzero","product":"platform"},{"vendor":"shopware","product":"platform"},{"vendor":"shopware","product":"shopware"}],"references":[{"url":"https://github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/shopware/shopware/commit/fd6d39bdb62dfa06fe62c7c87b37607d84094cda","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/shopware/shopware/releases/tag/v6.6.10.18","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/shopware/shopware/releases/tag/v6.7.10.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-xvhc-gm7j-mhmc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48015.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48015","tags":["advisory"]},{"url":"https://github.com/shopware/shopware","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48015","title":"Shopware: Stored XSS via SVG file upload — no SVG sanitization","description":"Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, \u003cscript\u003e, and \u003cforeignObject\u003e to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.","status":"published","published":"2026-07-17T17:53:01.695Z","modified":"2026-07-17T18:11:57.809Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-45238","description":"Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, \u003cscript\u003e, and \u003cforeignObject\u003e to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.","status":"published","published":"2026-07-17T17:53:01Z","modified":"2026-07-17T18:11:57Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:50.451546Z"}],"ghsa":[{"id":"GHSA-xvhc-gm7j-mhmc","title":"Shopware: Stored XSS via SVG file upload — no SVG sanitization","description":"SVG files are in the `allowed_extensions` whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (`onload`, `\u003cscript\u003e`, `\u003cforeignObject\u003e`) executes in the context of the Shopware domain when accessed.\n\n## The Problem\n\nIn `src/Core/Framework/Resources/config/packages/shopware.yaml`, line 194:\n\n```yaml\nallowed_extensions: [\"jpg\", \"jpeg\", \"png\", \"webp\", \"avif\", \"gif\", \"svg\", ...]\n```\n\nSVG is whitelisted. The upload path (`MediaUploadController` → `FileSaver` → `TypeDetector`) recognizes SVG as `ImageType` with `VECTOR_GRAPHIC` flag, but no code strips JavaScript, event handlers, or external entity references from the SVG XML.\n\nA search of the entire codebase for SVG sanitization returns — no `DOMPurify`, no `svg-sanitize`, no `strip_tags` on SVG content, nothing.\n\n## Impact\n\nStored XSS affecting all users who view the uploaded SVG. In an e-commerce context, this can lead to admin account takeover, customer data theft, or malicious plugin installation.\n\n## Suggested Fix\n\nEither:\n\n1. **Remove SVG from `allowed_extensions`** if SVG upload is not a core requirement\n2. **Sanitize SVG content** on upload using a library like `enshrined/svg-sanitize` (strips scripts, event handlers, external references)\n3. **Serve SVGs with `Content-Disposition: attachment`** to prevent inline rendering\n4. **Serve SVGs from a separate domain** (like Nextcloud's `usercontent.apps.nextcloud.com`)\n\nOption 2 is the most practical — `enshrined/svg-sanitize` is already used by WordPress and other PHP projects.\n\nRegards \u0026 BG,\nKeyvan Hardani","status":"published","published":"2026-06-04T19:35:26Z","modified":"2026-06-04T19:35:28Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-48015","description":"Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, \u003cscript\u003e, and \u003cforeignObject\u003e to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.","status":"published","published":"2026-07-17T18:17:16.323Z","modified":"2026-07-17T19:17:15.72Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-48015","title":"Shopware: Stored XSS via SVG file upload — no SVG sanitization","description":"Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, \u003cscript\u003e, and \u003cforeignObject\u003e to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.","status":"published","published":"2026-07-17T17:53:01.695Z","modified":"2026-11-05T10:45:59.133293394Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"GHSA-xvhc-gm7j-mhmc","title":"Shopware: Stored XSS via SVG file upload — no SVG sanitization","description":"SVG files are in the `allowed_extensions` whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (`onload`, `\u003cscript\u003e`, `\u003cforeignObject\u003e`) executes in the context of the Shopware domain when accessed.\n\n## The Problem\n\nIn `src/Core/Framework/Resources/config/packages/shopware.yaml`, line 194:\n\n```yaml\nallowed_extensions: [\"jpg\", \"jpeg\", \"png\", \"webp\", \"avif\", \"gif\", \"svg\", ...]\n```\n\nSVG is whitelisted. The upload path (`MediaUploadController` → `FileSaver` → `TypeDetector`) recognizes SVG as `ImageType` with `VECTOR_GRAPHIC` flag, but no code strips JavaScript, event handlers, or external entity references from the SVG XML.\n\nA search of the entire codebase for SVG sanitization returns — no `DOMPurify`, no `svg-sanitize`, no `strip_tags` on SVG content, nothing.\n\n## Impact\n\nStored XSS affecting all users who view the uploaded SVG. In an e-commerce context, this can lead to admin account takeover, customer data theft, or malicious plugin installation.\n\n## Suggested Fix\n\nEither:\n\n1. **Remove SVG from `allowed_extensions`** if SVG upload is not a core requirement\n2. **Sanitize SVG content** on upload using a library like `enshrined/svg-sanitize` (strips scripts, event handlers, external references)\n3. **Serve SVGs with `Content-Disposition: attachment`** to prevent inline rendering\n4. **Serve SVGs from a separate domain** (like Nextcloud's `usercontent.apps.nextcloud.com`)\n\nOption 2 is the most practical — `enshrined/svg-sanitize` is already used by WordPress and other PHP projects.\n\nRegards \u0026 BG,\nKeyvan Hardani","status":"published","published":"2026-06-04T19:35:26Z","modified":"2026-09-10T03:51:09.882226415Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:47:00.604718Z"}]}}