CVE-2020-13971: Shopware vulnerable to Cross-site Scripting

The vulnerability stems from improper input validation in media upload handling. Key functions in the media upload workflow (FileSaver and MediaService) would be responsible for processing uploaded files. The persistence of raw SVG files with embedded JavaScript indicates these components failed to: 1) validate SVG content structure, 2) sanitize dangerous elements, and 3) implement proper Content Security Policy. The high confidence comes from the vulnerability pattern matching typical media handling implementations in Shopware's architecture and the explicit mention of Mediabrowser fileupload as the attack vector.