What is the CVSS score of CVE-2026-48015?

CVE-2026-48015 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48015?

Yes, a patch is available for CVE-2026-48015. Update the affected software to the latest version immediately.

Shopware CVE-2026-48015

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-04 https://github.com/shopware/shopware

GHSA-xvhc-gm7j-mhmc

Nextcloud XSS WordPress PHP

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 20:02 vuln.today

Analysis Generated

Jun 04, 2026 - 20:02 vuln.today

CVE Published

Jun 04, 2026 - 19:35 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

SVG files are in the allowed_extensions whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (onload, <script>, <foreignObject>) executes in the context of the Shopware domain when accessed.

The Problem

In src/Core/Framework/Resources/config/packages/shopware.yaml, line 194:

yaml

allowed_extensions: ["jpg", "jpeg", "png", "webp", "avif", "gif", "svg", ...]

SVG is whitelisted. The upload path (MediaUploadController → FileSaver → TypeDetector) recognizes SVG as ImageType with VECTOR_GRAPHIC flag, but no code strips JavaScript, event handlers, or external entity references from the SVG XML.

A search of the entire codebase for SVG sanitization returns - no DOMPurify, no svg-sanitize, no strip_tags on SVG content, nothing.

Impact

Stored XSS affecting all users who view the uploaded SVG. In an e-commerce context, this can lead to admin account takeover, customer data theft, or malicious plugin installation.

Suggested Fix

Either:

Remove SVG from allowed_extensions if SVG upload is not a core requirement
Sanitize SVG content on upload using a library like enshrined/svg-sanitize (strips scripts, event handlers, external references)
Serve SVGs with Content-Disposition: attachment to prevent inline rendering
Serve SVGs from a separate domain (like Nextcloud's usercontent.apps.nextcloud.com)

Option 2 is the most practical - enshrined/svg-sanitize is already used by WordPress and other PHP projects.

Regards & BG, Keyvan Hardani

AnalysisAI

Stored cross-site scripting in Shopware's media manager allows any authenticated admin to upload an unsanitized SVG file containing arbitrary JavaScript that executes in the Shopware domain context when the file is accessed by any user. The upload pipeline - spanning MediaUploadController, FileSaver, and TypeDetector - classifies SVG as a valid ImageType with VECTOR_GRAPHIC flag but performs zero content sanitization: no DOMPurify, no enshrined/svg-sanitize, no strip_tags on SVG XML content. In an e-commerce context this enables admin account takeover, customer data exfiltration, and malicious plugin installation. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.

Technical ContextAI

SVG is an XML-based image format that the W3C specification allows to embed JavaScript via inline event handlers (onload, onmouseover), script elements, and foreignObject tags. Shopware (PHP, Composer packages shopware/core and shopware/platform) whitelists SVG in src/Core/Framework/Resources/config/packages/shopware.yaml at line 194 under allowed_extensions. The upload processing chain recognizes the format as a legitimate image type but lacks any XML parsing or sanitization step that would strip executable content before persisting the file. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) is the root cause class: user-controlled data (SVG XML content) reaches the browser without sanitization, enabling stored script injection. Affected Composer packages are shopware/core and shopware/platform covering both the 6.6.x and 6.7.x release branches.

RemediationAI

Upgrade shopware/core and shopware/platform to version 6.6.10.18 (for 6.6.x deployments) or 6.7.10.1 (for 6.7.x deployments) - these are vendor-released patches confirmed by GitHub release tags at https://github.com/shopware/shopware/releases/tag/v6.6.10.18 and https://github.com/shopware/shopware/releases/tag/v6.7.10.1. If immediate upgrade is not feasible, three workarounds exist with distinct trade-offs: (1) Remove SVG from the allowed_extensions list in shopware.yaml - eliminates the attack surface entirely but breaks any store functionality relying on SVG image uploads; (2) Configure the web server to serve files under the media directory with the Content-Disposition: attachment header for SVG MIME types - forces downloads rather than inline rendering, preventing XSS execution, but disrupts legitimate SVG display use cases; (3) Restrict the media manager to highly trusted admin accounts only via ACL configuration - reduces exposure but does not eliminate it since the vulnerability requires only standard admin access. Adding the enshrined/svg-sanitize Composer library (already used by WordPress) for upload-time sanitization is noted as the most practical long-term fix per the advisory author.