GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-xvhc-gm7j-mhmcmedium4.9

Shopware: Stored XSS via SVG file upload — no SVG sanitization

Impact

SVG files are in the allowed_extensions whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (onload, , ) executes in the context of the Shopware domain when accessed.

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

shopware/core Packagist
Affected rangeRecorded fix
From 6.7.0.0 before 6.7.10.1Ecosystem versions6.7.10.1
Earlier releases before 6.6.10.18Ecosystem versions6.6.10.18

Version evidence: OSV · GHSA-xvhc-gm7j-mhmc

View original version evidence (192 explicit versions)
shopware/platform Packagist
Affected rangeRecorded fix
From 6.7.0.0 before 6.7.10.1Ecosystem versions6.7.10.1
Earlier releases before 6.6.10.18Ecosystem versions6.6.10.18

Version evidence: OSV · GHSA-xvhc-gm7j-mhmc

View original version evidence (192 explicit versions)

Original source description

SVG files are in the allowed_extensions whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (onload, <script>, <foreignObject>) executes in the context of the Shopware domain when accessed.

The Problem

In src/Core/Framework/Resources/config/packages/shopware.yaml, line 194:

allowed_extensions: ["jpg", "jpeg", "png", "webp", "avif", "gif", "svg", ...]

SVG is whitelisted. The upload path (MediaUploadController → FileSaver → TypeDetector) recognizes SVG as ImageType with VECTOR_GRAPHIC flag, but no code strips JavaScript, event handlers, or external entity references from the SVG XML.

A search of the entire codebase for SVG sanitization returns — no DOMPurify, no svg-sanitize, no strip_tags on SVG content, nothing.

Impact

Stored XSS affecting all users who view the uploaded SVG. In an e-commerce context, this can lead to admin account takeover, customer data theft, or malicious plugin installation.

Suggested Fix

Either:

  1. Remove SVG from allowed_extensions if SVG upload is not a core requirement
  2. Sanitize SVG content on upload using a library like enshrined/svg-sanitize (strips scripts, event handlers, external references)
  3. Serve SVGs with Content-Disposition: attachment to prevent inline rendering
  4. Serve SVGs from a separate domain (like Nextcloud's usercontent.apps.nextcloud.com)

Option 2 is the most practical — enshrined/svg-sanitize is already used by WordPress and other PHP projects.

Regards & BG, Keyvan Hardani

References