The `/api/_action/media/external-link` endpoint in Shopware allows authenticated administrators to issue HTTP HEAD requests to arbitrary URLs. Prior to 6.6.10.18 and 6.7.10.1, the linkURL flow only enforces a basic regex that the URL starts with http:// or https://, omitting any validation of the target IP address. Because the uploadFromURL flow uses the FileUrlValidator to restrict target IPs to private or reserved ranges, this divergence creates a Server‑Side Request Forgery (SSRF) vulnerability, classified as CWE‑918.

Affected installations include the Shopware Platform and the Shopware product running any version earlier than 6.6.10.18 for the 6.6 branch and 6.7.10.1 for the 6.7 branch. Only accounts with administrator privileges on the platform can invoke the problematic endpoint.

The CVSS score of 4.1 indicates moderate severity, while the EPSS score of less than 1% points to a low probability of exploitation in the wild, and the vulnerability is not registered in the CISA KEV catalog. Exploitation requires an authenticated admin session and the ability to call the external‑link API. The description explicitly states that the flaw permits SSRF to internal network services and cloud metadata endpoints. Based on the description, it is inferred that an attacker could use access to a cloud metadata service to obtain configuration credentials or other sensitive data, although such impact is not directly documented in the advisory.