Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/core | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/platform | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) caused by inconsistent URL validation within Shopware's MediaUploadService. The linkURL feature, exposed via the /api/_action/media/external-link API endpoint, allowed authenticated admin users to specify a URL for an external media file. The backend would then fetch metadata from this URL.
The root cause was that the validation for this feature, specifically in the MediaUploadService::getContentSizeFromValidExternalUrl function, only checked if the URL started with http:// or https://. It did not validate the resolved IP address, unlike the uploadFromURL feature which correctly used a FileUrlValidator to block requests to private and reserved IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16, 169.254.169.254).
This discrepancy allowed an attacker with admin credentials to make the server issue HTTP HEAD requests to any IP address, including services on the internal network and cloud metadata endpoints. This could be used for network scanning and information gathering.
The patch, identified in commit 545b8ac325dd292422a8c2354778da826f4f7f19, rectifies this by applying the same strict FileUrlValidator to the external-link flow. It introduces a new method, assertValidExternalUrl, which performs both the format check and the IP address validation, and applies it to all functions handling external URLs, thereby closing the SSRF loophole.
Shopware\Core\Content\Media\Upload\MediaUploadService::getContentSizeFromValidExternalUrlsrc/Core/Content/Media/Upload/MediaUploadService.php
Shopware\Core\Content\Media\Upload\MediaUploadService::linkURLsrc/Core/Content/Media/Upload/MediaUploadService.php
Shopware\Core\Content\Media\Api\MediaUploadV2Controller::externalLinksrc/Core/Content/Media/Api/MediaUploadV2Controller.php
Shopware\Core\Content\Media\Upload\MediaUploadService::addExternalThumbnailsToMediasrc/Core/Content/Media/Upload/MediaUploadService.php