CVE-2026-48015: Shopware Core and Platform Stored XSS via SVG File Upload
Summary
CVE-2026-48015: Shopware: Stored XSS via SVG file upload — no SVG sanitization. Affects shopware/core across 2 version ranges.
< 6.6.10.18
>= 6.7.0.0, < 6.7.10.1
Fixed in 6.6.10.18 or 6.7.10.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and various payment options. The platform is widely used for its flexibility and extensibility, allowing developers to create custom plugins and themes. However, it has a vulnerability that allows for stored cross-site scripting (XSS) attacks through SVG file uploads, which can compromise the security of the application.
Vulnerability Detail
The vulnerability arises from the fact that SVG files are included in the 'allowed_extensions' whitelist and can be uploaded by any admin user without any sanitization of the SVG content. This means that a malicious SVG file containing JavaScript can be executed in the context of the Shopware domain when accessed. The lack of sanitization allows for the execution of scripts, which can lead to severe consequences such as admin account takeover, customer data theft, or the installation of malicious plugins.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.6.10.186.6.10.18composer require shopware/core:6.6.10.18 -
>= 6.7.0.0, < 6.7.10.16.7.10.1composer require shopware/core:6.7.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can remove SVG from the 'allowed_extensions' list in the configuration file located at 'src/Core/Framework/Resources/config/packages/shopware.yaml'. This can be done by modifying the line: allowed_extensions: ["jpg", "jpeg", "png", "webp", "avif", "gif", ...] to exclude 'svg'. Alternatively, serve SVGs with 'Content-Disposition: attachment' to prevent inline rendering.
Conclusion
The vulnerability CVE-2026-48015 in Shopware Core and Platform allows for stored XSS attacks through SVG file uploads due to a lack of content sanitization. It is crucial to update to the patched versions to mitigate the risks associated with this vulnerability. Implementing additional sanitization measures can further enhance security.
See every vulnerability recorded for shopware/core →
FAQ
The impact includes potential admin account takeover, customer data theft, and the ability to install malicious plugins, affecting all users who view the uploaded SVG.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.9, indicating a moderate level of risk.
Yes, you can use libraries like 'enshrined/svg-sanitize' to sanitize SVG content on upload, which strips scripts and event handlers.
If you cannot update immediately, consider removing SVG from the allowed extensions or serving SVGs with 'Content-Disposition: attachment' as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
