CVE-2026-48015 : 상세 정보

CVE-2026-48015

4.9
/
보통
2026-07-17
18h17 +00:00
Cross-site Scripting
A03-Injection
Network
2026-07-17
19h17 +00:00
CVE.org
NVD
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
알림 관리

CVE 설명

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from MediaUploadController to FileSaver to TypeDetector, allowing malicious SVG JavaScript such as onload,