CVE-2020-13971: 
PHP vulnerability analysis and mitigation

In Shopware before version 6.2.3, authenticated users could exploit a vulnerability related to the Mediabrowser fileupload feature, which allowed them to upload SVG images containing malicious JavaScript code (NVD).

The vulnerability exists in the Mediabrowser fileupload feature of Shopware, where the application failed to properly validate SVG file uploads. This allowed authenticated users to upload SVG files containing embedded JavaScript code, which could potentially be executed (NVD).

The vulnerability could allow authenticated users to execute arbitrary JavaScript code through maliciously crafted SVG files, potentially leading to cross-site scripting (XSS) attacks (Shopware Docs).

The vulnerability requires authentication to exploit, as only authenticated users have access to the Mediabrowser fileupload feature. The attacker would need to upload a specially crafted SVG file containing malicious JavaScript code (NVD).

The vulnerability was fixed in Shopware version 6.2.3. Users are strongly recommended to upgrade to this version or later. For older versions of 6.1, the fix is available through the Shopware 6 Security Plugin (Shopware Docs).