Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the lack of SVG content sanitization during file upload. The analysis of the provided patch commit 745a3ea3b77d4fe0f78c595ef527d8453a134497 reveals the exact point of failure and the subsequent fix.
The core of the vulnerability was in the Shopware\Core\Content\Media\File\FileSaver::persistFileToMedia method. This method is responsible for saving media files to the filesystem. The vulnerability existed because this method did not perform any content validation on the files it was saving; it only checked for allowed file extensions. Since .svg was an allowed extension, a user could upload a crafted SVG file containing executable JavaScript (e.g., via onload or <script> tags).
The patch addresses this by introducing a new validation step within persistFileToMedia. A new service, FileContentValidationStrategy, is called to validate the file content before it is saved. This strategy, in turn, uses a new SvgContentValidator class. This validator parses the SVG file using an XML reader and strictly checks all elements, attributes, and references against a pre-defined allowlist, effectively stripping any potentially malicious or active content. Any SVG file that contains disallowed elements or attributes is rejected, and the upload fails, preventing the stored XSS.
Therefore, the persistFileToMedia function is identified as the vulnerable function because it was the component that improperly trusted and saved the malicious user input.
Shopware\Core\Content\Media\File\FileSaver::persistFileToMediasrc/Core/Content/Media/File/FileSaver.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/core | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/core | composer | < 6.6.10.18 | 6.6.10.18 |
| shopware/platform |
| composer |
| >= 6.7.0.0, < 6.7.10.1 |
| 6.7.10.1 |
| shopware/platform | composer | < 6.6.10.18 | 6.6.10.18 |