CVE-2026-48015: Shopware SVG XSS Vulnerability

CVE-2026-48015 Overview

CVE-2026-48015 is a stored cross-site scripting (XSS) vulnerability in Shopware, an open commerce platform. Shopware versions prior to 6.6.10.18 and 6.7.10.1 include SVG in the allowed_extensions whitelist within src/Core/Framework/Resources/config/packages/shopware.yaml. Authenticated users can upload SVG files via the media manager without any SVG sanitization along the pipeline from MediaUploadController to FileSaver to TypeDetector. Malicious SVG payloads using onload, <script>, or <foreignObject> execute in the Shopware domain when the uploaded file is viewed. The issue is fixed in versions 6.6.10.18 and 6.7.10.1.

Critical Impact
Attackers with upload privileges can inject persistent JavaScript into the Shopware application origin, enabling session theft, administrative action hijacking, and further account compromise. [CWE-79]

Affected Products

Shopware versions prior to 6.6.10.18 (6.6.x branch)
Shopware versions prior to 6.7.10.1 (6.7.x branch)
Shopware media manager component (MediaUploadController, FileSaver, TypeDetector)

Discovery Timeline

2026-07-17 - CVE-2026-48015 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-48015

Vulnerability Analysis

The vulnerability is a stored XSS flaw rooted in Shopware's media upload pipeline. Shopware's default configuration lists svg among the allowed upload extensions in shopware.yaml. When a user uploads a file, the request traverses MediaUploadController, is persisted by FileSaver, and inspected by TypeDetector. None of these components strip active SVG content before storage or delivery. SVG is an XML-based format that supports embedded scripts, event handlers, and <foreignObject> HTML content. When the stored SVG is later requested directly from the Shopware origin, the browser parses it as an active document and executes any embedded JavaScript. The payload then runs with the privileges and cookies of the viewing user, including administrators.

Root Cause

The root cause is missing content sanitization for a file type that supports active content. Extension-based allow-listing treats SVG as a static image while browsers treat it as an executable XML document. There is no HTML/attribute filtering or Content-Security-Policy enforcement that would neutralize embedded scripts before delivery.

Attack Vector

An attacker with upload permissions crafts an SVG containing <script> elements, onload handlers, or <foreignObject> with HTML. They upload it through the media manager. Any user, including an administrator, who views or previews the file triggers script execution in the Shopware domain, enabling session hijacking, CSRF token theft, or admin action abuse.

text

// Patch excerpt: composer.json + config-schema.json additions
// Source: https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497

"svg": {
    "type": "object",
    "additionalProperties": false,
    "properties": {
        "allowed_elements": {
            "type": "array",
            "uniqueItems": true,
            "items": { "type": "string" }
        },
        "allowed_attributes": {
            "type": "array",
            "uniqueItems": true,
            "items": { "type": "string" }
        },
        "allowed_reference_attributes": {
            "type": "array",
            "uniqueItems": true,
            "items": { "type": "string" }
        }
    }
}

The patch introduces a configurable allow-list of SVG elements, attributes, and reference attributes. Uploads containing anything outside these lists are rejected. See the Shopware commit 745a3ea and the 6.6.x backport fd6d39b.

Detection Methods for CVE-2026-48015

Indicators of Compromise

SVG files stored in the Shopware media directory containing <script>, onload=, onerror=, onclick=, or <foreignObject> tags.
Web server access logs showing GET requests to .svg assets under /media/ immediately followed by anomalous administrative API calls from the same session.
Unexpected outbound HTTP requests originating from browser sessions after loading Shopware admin or storefront pages that render user-uploaded media.

Detection Strategies

Scan the media storage backend for uploaded SVG files and inspect their contents for active elements and event-handler attributes.
Compare current shopware.yamlallowed_extensions values against a hardened baseline and flag any environment where svg remains listed on unpatched versions.
Correlate media upload events with the uploading user's role; alert when non-privileged users or newly created accounts upload SVG assets.

Monitoring Recommendations

Enable audit logging on the MediaUploadController endpoint and forward events to a SIEM for review.
Monitor administrator sessions for anomalous XHR or fetch activity following media previews, which can indicate XSS-driven session abuse.
Track Shopware version inventory across environments and alert on hosts running versions earlier than 6.6.10.18 or 6.7.10.1.

How to Mitigate CVE-2026-48015

Immediate Actions Required

Upgrade Shopware to 6.6.10.18 or 6.7.10.1 immediately following the vendor release notes.
Audit existing SVG uploads in the media library and remove any files containing scripts, event handlers, or <foreignObject> elements.
Rotate administrator session tokens and credentials if unsanitized SVG assets are found in production media storage.
Restrict media upload permissions to trusted accounts and review recent role assignments.

Patch Information

The vendor released fixes in Shopware 6.6.10.18 and 6.7.10.1. Both patches add an SVG sanitization allow-list schema and reject active SVG content during upload. Refer to the GitHub Security Advisory GHSA-xvhc-gm7j-mhmc and the Shopware v6.6.10.18 release for full details.

Workarounds

Remove svg from the allowed_extensions list in src/Core/Framework/Resources/config/packages/shopware.yaml if upgrading is not immediately possible.
Serve user-uploaded media from a separate cookieless domain to isolate any executed script from the primary Shopware session.
Deploy a strict Content-Security-Policy header disallowing inline scripts on responses that deliver user-uploaded content.
Place a web application firewall rule in front of the media endpoint to reject SVG uploads containing <script, onload, or <foreignObject> substrings.

bash

# Configuration example: disable SVG uploads until patched
# Edit: src/Core/Framework/Resources/config/packages/shopware.yaml

shopware:
  filesystem:
    allowed_extensions:
      - jpg
      - jpeg
      - png
      - gif
      - webp
      # - svg   # Removed to mitigate CVE-2026-48015

# Then clear the container cache
bin/console cache:clear