https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T08:05:29.769800+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338576 EUVD-2026-338576 2026-10-07T08:05:29.771884+00:00 EUVD-2026-338576 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48015 fkie_cve-2026-48015 2026-10-07T08:05:29.771915+00:00

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload, <script>, and <foreignObject> to execute in the Shopware domain when the uploaded SVG is viewed. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

 https://cve.radiocsirt.org/vuln/ghsa-xvhc-gm7j-mhmc GHSA-xvhc-gm7j-mhmc — Shopware: Stored XSS via SVG file upload — no SVG sanitization 2026-10-07T08:05:29.771946+00:00

Affected: Packagist: shopware/core, Packagist: shopware/platform

SVG files are in the `allowed_extensions` whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (`onload`, `<script>`, `<foreignObject>`) executes in the context of the Shopware domain when accessed.

## The Problem

In `src/Core/Framework/Resources/config/packages/shopware.yaml`, line 194:

```yaml allowed_extensions: ["jpg", "jpeg", "png", "webp", "avif", "gif", "svg", ...] ```

SVG is whitelisted. The upload path (`MediaUploadController` → `FileSaver` → `TypeDetector`) recognizes SVG as `ImageType` with `VECTOR_GRAPHIC` flag, but no code strips JavaScript, event handlers, or external entity references from the SVG XML.

A search of the entire codebase for SVG sanitization returns — no `DOMPurify`, no `svg-sanitize`, no `strip_tags` on SVG content, nothing.

## Impact

Stored XSS affecting all users who view the uploaded SVG. In an e-commerce context, this can lead to admin account takeover, customer data theft, or malicious plugin installation.

## Suggested Fix

Either:

1. **Remove SVG from `allowed_extensions`** if SVG upload is not a core requirement 2. **Sanitize SVG content** on upload using a library like `enshrined/svg-sanitize` (strips scripts, event handlers, external references) 3. **Serve SVGs with `Content-Disposition: attachment`** to prevent inline rendering 4. **Serve SVGs from a separate domain** (like Nextcloud's `usercontent.apps.next…