CVE-2026-48015: Shopware: Stored XSS via SVG file upload — no SVG sanitization

June 4, 2026

SVG files are in the allowed_extensions whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (onload, <script>, <foreignObject>) executes in the context of the Shopware domain when accessed.

References

github.com/advisories/GHSA-xvhc-gm7j-mhmc
github.com/shopware/shopware/releases/tag/v6.6.10.18
github.com/shopware/shopware/releases/tag/v6.7.10.1
github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc
nvd.nist.gov/vuln/detail/CVE-2026-48015

Code Behaviors & Features

Detect and mitigate CVE-2026-48015 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →