CVE-2026-48013: 
PHP vulnerability analysis and mitigation

CVE-2026-48013 is a Server-Side Request Forgery (SSRF) vulnerability in Shopware's media external-link endpoint that allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses and cloud metadata services. It affects shopware/core and shopware/platform versions >= 6.7.0.0 and < 6.7.10.1. The vulnerability was reported by researcher 0xEr3n, published on May 19, 2026, and added to the GitHub Advisory Database on June 4, 2026. It carries a CVSS v3.1 base score of 4.1 (Moderate) (GitHub Advisory, Shopware Advisory).

The root cause (CWE-918) is an inconsistency between two URL-handling flows in MediaUploadService. The uploadFromURL flow correctly validates target IPs against private/reserved ranges using FileUrlValidator::isValid(), which resolves hostnames via gethostbyname() and applies filter_var() with FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the linkURL flow — triggered via MediaUploadV2Controller::externalLink() at MediaUploadV2Controller.php:66 — only performs a regex check for an http:// or https:// prefix before issuing a server-side HEAD request with no IP filtering. Additionally, Symfony HttpClient follows up to 20 redirects by default, enabling redirect-based SSRF escalation where an attacker-controlled external server redirects the HEAD request to arbitrary internal destinations (GitHub Advisory, Shopware Advisory).

Exploitation is limited to information disclosure via HTTP HEAD requests, with no integrity or availability impact. An authenticated admin can probe cloud metadata services (e.g., 169.254.169.254) to confirm their existence and leak content-length values, perform internal network port scanning on RFC-1918 ranges (10.x, 172.16.x, 192.168.x) by analyzing response timing and error types, and indirectly leak internal service information since the fileSize field stored in the database reflects the content-length header returned by internal services. In multi-tenant environments or compromised-credential scenarios, this enables meaningful network reconnaissance from the server's perspective (GitHub Advisory).

1. Obtain admin credentials: Acquire valid Shopware admin credentials through phishing, credential stuffing, or another compromise vector targeting the admin panel.
2. Authenticate to the API: Obtain a valid API bearer token by authenticating against the Shopware admin API (e.g., POST /api/oauth/token).
3. Craft the SSRF request: Send an authenticated HTTP POST request to /api/_action/media/external-link with a url parameter pointing to an internal target, such as the cloud metadata endpoint:

POST /api/_action/media/external-link
Authorization: Bearer <token>
Content-Type: application/json

{"url": "http://169.254.169.254/latest/meta-data/"}

4. Probe internal network: Iterate over internal IP ranges and ports (e.g., http://10.0.0.1:8080/) to identify open services based on response timing, error messages, or the fileSize value stored in the database.
5. Redirect-based escalation: Host an attacker-controlled server that returns an HTTP redirect to an internal target, bypassing any future hostname-based checks and leveraging Symfony HttpClient's default redirect-following behavior (up to 20 hops).
6. Exfiltrate metadata: Correlate content-length values returned (and stored in the database's fileSize field) with known internal service responses to infer service types and configurations (GitHub Advisory, Shopware Advisory).

• Network: Outbound HTTP HEAD requests from the Shopware application server to RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or the link-local metadata IP 169.254.169.254; outbound HEAD requests to external servers that subsequently redirect to internal destinations.
• Logs: Shopware API access logs showing repeated POST requests to /api/_action/media/external-link with url parameters containing internal IP addresses or cloud metadata URLs; unusual patterns of requests to this endpoint from a single admin account in a short time window.
• Database: Media records in the database with fileSize values that correspond to content-length headers from internal services rather than legitimate external media files; media entries with internal IP addresses or metadata URLs as their source.

Shopware has released version 6.7.10.1 as a security fix, which aligns the URL validation in the external-link endpoint with the existing upload-from-url flow by applying FileUrlValidator to the linkURL path. The static MediaUploadService::validateExternalUrl() method is deprecated in favor of the new assertValidExternalUrl() method. Administrators should upgrade shopware/core and shopware/platform to version 6.7.10.1 or later immediately. As an additional hardening measure, Shopware recommends setting max_redirects: 0 on the HttpClient request to prevent redirect-based SSRF bypasses (Shopware Release, GitHub Advisory).

The vulnerability was reported by security researcher 0xEr3n and published by Shopware maintainer mkraeml on May 19, 2026, as part of a broader security release (v6.7.10.1) that addressed nine security issues including privilege escalation, account takeover, and XSS vulnerabilities. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (Shopware Release, Shopware Advisory).