Cross-site scripting in Shopware - CVE-2026-48015
Published: May 20, 2026
Vulnerability identifier: #VU131948
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-48015
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the context of the Shopware domain.
The vulnerability exists due to cross-site scripting in the SVG upload handling pipeline when processing uploaded SVG files. A remote privileged user can upload a specially crafted SVG file to execute arbitrary script in the context of the Shopware domain.
The issue affects users who access the uploaded SVG.
Affected software
Shopware
How to mitigate CVE-2026-48015
Install security update from vendor's website.
Shopware - addressed in versions 6.6.10.18, 6.7.10.1