4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48015

CVE-2026-48015: Shopware: Stored XSS via SVG file upload — no SVG sanitization

SVG files are in the allowed_extensions whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (onload, <script>, <foreignObject>) executes in the context of the Shopware domain when accessed.

The Problem

In src/Core/Framework/Resources/config/packages/shopware.yaml, line 194:

allowed_extensions: ["jpg", "jpeg", "png", "webp", "avif", "gif", "svg", ...]

SVG is whitelisted. The upload path (MediaUploadController → FileSaver → TypeDetector) recognizes SVG as ImageType with VECTOR_GRAPHIC flag, but no code strips JavaScript, event handlers, or external entity references from the SVG XML.

A search of the entire codebase for SVG sanitization returns — no DOMPurify, no svg-sanitize, no strip_tags on SVG content, nothing.

Impact

Stored XSS affecting all users who view the uploaded SVG. In an e-commerce context, this can lead to admin account takeover, customer data theft, or malicious plugin installation.

Suggested Fix

Either:

Remove SVG from allowed_extensions if SVG upload is not a core requirement
Sanitize SVG content on upload using a library like enshrined/svg-sanitize (strips scripts, event handlers, external references)
Serve SVGs with Content-Disposition: attachment to prevent inline rendering
Serve SVGs from a separate domain (like Nextcloud's usercontent.apps.nextcloud.com)

Option 2 is the most practical — enshrined/svg-sanitize is already used by WordPress and other PHP projects.

Regards & BG, Keyvan Hardani

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48015

CVE-2026-48015:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
shopware/core	composer	>= 6.7.0.0, < 6.7.10.1	6.7.10.1
shopware/core	composer	< 6.6.10.18	6.6.10.18
shopware/platform

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of SVG content sanitization during file upload. The analysis of the provided patch commit 745a3ea3b77d4fe0f78c595ef527d8453a134497 reveals the exact point of failure and the subsequent fix.

The core of the vulnerability was in the Shopware\Core\Content\Media\File\FileSaver::persistFileToMedia method. This method is responsible for saving media files to the filesystem. The vulnerability existed because this method did not perform any content validation on the files it was saving; it only checked for allowed file extensions. Since .svg was an allowed extension, a user could upload a crafted SVG file containing executable JavaScript (e.g., via onload or <script> tags).

The patch addresses this by introducing a new validation step within persistFileToMedia. A new service, FileContentValidationStrategy, is called to validate the file content before it is saved. This strategy, in turn, uses a new SvgContentValidator class. This validator parses the SVG file using an XML reader and strictly checks all elements, attributes, and references against a pre-defined allowlist, effectively stripping any potentially malicious or active content. Any SVG file that contains disallowed elements or attributes is rejected, and the upload fails, preventing the stored XSS.

Therefore, the persistFileToMedia function is identified as the vulnerable function because it was the component that improperly trusted and saved the malicious user input.

Vulnerable functions

Shopware\Core\Content\Media\File\FileSaver::persistFileToMedia

src/Core/Content/Media/File/FileSaver.php

This function is responsible for persisting uploaded media files. Prior to the patch, it would save any file with an allowed extension (including SVG) without inspecting the file's content. This allowed an attacker to upload an SVG file containing malicious JavaScript. The function processed the malicious file and saved it to be served to other users, leading to a stored XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.