Shopware 6: Path Traversal via media.fileExtension leading to Remote Code Execution

Presentation

Shopware stores uploaded media under a managed directory, deriving the file name and extension from the media record. The fileExtension field of that record is writable through the Admin API.

HDW Sec found that Shopware does not sufficiently validate the extension on a media update, so an administration user holding the single media:update privilege can write files outside the media directory and reach remote code execution.

Issue(s)

• media.fileExtension is writable and is not validated against an allow-list on update, so it can carry traversal sequences and a dangerous extension.
• The value is used to build the destination path, which lets the write land outside the intended media directory.
• Where the resulting file is served by the PHP interpreter, this turns into arbitrary PHP execution and full compromise of the shop.
• The privilege required is narrow: media:update alone is enough, which is a privilege routinely granted to content roles and integrations rather than to administrators only.
• The vendor’s workaround is to restrict media:update to fully trusted users and integrations.

References

• GitHub advisory: GHSA-p67w-3mq7-rw2g
• Fixed in Shopware 6.7.13.1, published 2026-08-25. No CVE assigned as of publication.