Shopware CVE-2026-48015

Exploitation requires an authenticated Shopware admin account - the CVSS vector PR:H confirms high-privilege authentication is mandatory. The attack leverages the default Shopware configuration where SVG is included in the allowed_extensions whitelist in shopware.yaml (line 194); no non-default configuration is required. For payload delivery the attacker needs access to the admin media manager (/admin#/sw/media/index), which is restricted to admin panel users. Exploitation is limited by the requirement for admin credentials, meaning threat scenarios include insider threats, compromised admin accounts, or phishing of admin users. A secondary limiting condition is that a victim must access the uploaded SVG URL (or a page embedding it) for the stored XSS payload to execute. The CVSS UI:N scoring conflicts with this requirement - defenders should treat this as a UI:R scenario pending vendor clarification, which would reduce the realistic exploitation surface.

The CVSS 3.1 base score of 4.9 (Medium) reflects the high privileges prerequisite (PR:H - admin account required) as the primary risk limiter, combined with a High confidentiality impact (C:H) and unchanged scope (S:U). The AV:N/AC:L components confirm network-based exploitation with low attack complexity once admin access is obtained. A notable scoring discrepancy exists: the CVSS vector specifies UI:N (no user interaction), which is atypical for stored XSS where payload execution generally requires a victim to access the malicious resource - this may reflect a scenario where the SVG is embedded in a page that auto-loads it, or may represent an error in the CVSS scoring that defenders should verify against the vendor advisory. Additionally, the integrity impact is scored I:N despite the description explicitly noting potential admin account takeover and malicious plugin installation, suggesting the CVSS score may understate real-world impact. No EPSS data was provided in the intelligence input. The vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis, making this a lower-urgency remediation item unless admin credentials are at elevated risk of compromise in the target environment.

An attacker who has obtained or holds a Shopware admin account crafts an SVG file containing a JavaScript payload via an onload event handler or embedded script tag, then uploads it through the media manager interface, which accepts it without sanitization. Any user - including other admins or customers - whose browser renders the SVG inline (e.g., via a direct URL or embedded in a storefront page) triggers the script execution in the Shopware origin context, allowing the attacker to steal session cookies, exfiltrate customer data, or invoke authenticated admin API calls to install a malicious plugin. No public exploit code has been identified at time of analysis.