CVE-2026-48015

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, <script>, and <foreignObject> to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

• CWE-79

• https://github.com/shopware/shopware/commit/745a3ea3b77d4fe0f78c595ef527d8453a134497
• https://github.com/shopware/shopware/commit/fd6d39bdb62dfa06fe62c7c87b37607d84094cda
• https://github.com/shopware/shopware/releases/tag/v6.6.10.18
• https://github.com/shopware/shopware/releases/tag/v6.7.10.1
• https://github.com/shopware/shopware/security/advisories/GHSA-xvhc-gm7j-mhmc

Published

Jul 17, 2026

Last Modified

Jul 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4801The Page Builder Gutenberg Blocks – CoBlocks plugin for Word…6.4
• CVE-2026-48010Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-48011Shopware is an open commerce platform. Prior to versions 6.6…3.7
• CVE-2026-48012Shopware is an open commerce platform. Versions 6.7.3.0 thro…4.3
• CVE-2026-48013Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.1
• CVE-2026-48014Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-48016Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.3
• CVE-2026-48017DbGate is cross-platform database manager. In versions 7.1.8…8.8
• CVE-2026-4802A flaw was found in Cockpit. This vulnerability allows a rem…8
• CVE-2026-48020Traefik is an HTTP reverse proxy and load balancer. Prior to…10
• CVE-2026-48021In epa4all, prior to version 2026-05-20, an attacker who can…9.1
• CVE-2026-48022@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wrec…6.5