A flaw in Shopware’s media upload pipeline allows an attacker to upload an SVG file that is listed in the allowed_extensions whitelist and reaches the upload controller without any content sanitization. The SVG may contain malicious JavaScript in elements such as onload, <script>, or <foreignObject>. When the stored SVG is later viewed via the storefront, the embedded script executes with the privileges of the page, enabling session hijacking, credential theft, or other XSS attacks. The vulnerability is a Stored Input Validation flaw, CWE‑79, and is remedied in versions 6.6.10.18 and 6.7.10.1.

The issue exists in Shopware Platform and Shopware products before version 6.6.10.18 and 6.7.10.1. Any installation with these earlier releases that allows SVG uploads is vulnerable. Versions 6.6.10.18, 6.7.10.1, or later no longer allow unsanitized SVG uploads.

The CVSS score of 4.9 indicates moderate severity and the EPSS score of < 1 % shows low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack conditions require an attacker with permission to upload media via the Shopware media manager; once an SVG is uploaded, mere viewing of the file triggers the XSS payload.