CVE-2026-48015 Shopware: Stored XSS via SVG file upload — no SVG sanitization
Attackers can execute malicious JavaScript in the Shopware domain by uploading unsanitized SVG files, potentially leading to session hijacking or data theft.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48015?
CVE-2026-48015 is a medium-severity cross-site scripting vulnerability in shopware platform, published on 17 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, <script>, and <foreignObject> to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-48015?
8 open source packages ship an affected version, including shopware/platform and shopware/core.
| Package | Affected | Fixed in |
|---|---|---|
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | All versions | 6.6.10.18 |
shopware/core Packagist | All versions | 6.6.10.18 |
2 more packages
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
How do I fix CVE-2026-48015?
Upgrade shopware/platform to a fixed version for your release line: 6.6.10.18 or 6.7.10.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-48015 being exploited?
There is no known exploitation of CVE-2026-48015 in the wild and no public exploit code.
Sources
Also known as GHSA-xvhc-gm7j-mhmc.