CVE-2026-48013: Shopware Core and Platform SSRF Vulnerability in Media External-Link Endpoint

Background

Shopware is an open-source eCommerce platform that provides a comprehensive solution for online stores. It allows users to manage products, orders, and customer data efficiently. The platform is built on a modular architecture, enabling developers to extend its functionality. However, a vulnerability has been identified in the Media External-Link endpoint, which can lead to Server-Side Request Forgery (SSRF) attacks, allowing unauthorized access to internal services.

Vulnerability Detail

The vulnerability arises from an inconsistency in how the Shopware MediaUploadService handles URLs. The 'external-link' endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses without proper IP validation. While the 'uploadFromURL' flow correctly validates URLs against private and reserved IP ranges, the 'linkURL' flow only checks the URL format. This oversight can lead to information disclosure, allowing attackers to probe internal services, scan networks, and potentially leak sensitive information.

composer require shopware/core:6.7.10.1

Workaround

As a temporary workaround, you can modify the MediaUploadService to include IP validation in the 'linkURL' flow. Here is a code snippet to illustrate the necessary changes:

// src/Core/Content/Media/Upload/MediaUploadService.php

// Add constructor dependency:
private readonly FileUrlValidatorInterface $fileUrlValidator;

// In getContentSizeFromValidExternalUrl(), add IP validation:
private function getContentSizeFromValidExternalUrl(string $url): int
{
    $this->validateExternalUrl($url);

    if (!$this->fileUrlValidator->isValid($url)) {
        throw MediaException::illegalUrl($url);
    }

    $headers = $this->httpClient->request('HEAD', $url)->getHeaders();
    if (!array_key_exists('content-length', $headers)) {
        throw MediaException::fileNotFound($url);
    }

    return (int) $headers['content-length'][0];
}

Conclusion

In summary, CVE-2026-48013 is a significant SSRF vulnerability in the Shopware Core and Platform that can lead to serious information disclosure risks. It is crucial for users to update their installations to the patched version to mitigate these risks effectively.

See every vulnerability recorded for shopware/core →

FAQ