IT SBIT Services
Schneeberger
DEEN
CVE tracker

Shopware: Stored cross-site scripting via HTML media upload enabling admin token theft

CVE-2026-104937High 8.1

← All vulnerabilities

Summary

Shopware 6.7 accepts attacker-controlled HTML files in the media upload and serves them as text/html without effective security headers. When an administrator views such a file, embedded JavaScript can steal the administrator's authentication token. With that token, an attacker can access the Administration API, and if the account has extension-management rights, install malicious plugins for arbitrary PHP code execution as the Shopware process.

Affected

  • Shopware 6.7 (CERT/CC and CNA data; sub-versions unknown)
  • CWE-79 (Cross-site scripting)

Fixed in

  • Unknown. No patch or fixed version has been confirmed.
  • A Shopware PaaS maintenance titled "Deploying a security improvement" for this CVE was scheduled for 15 Oct 2026; it is unclear whether it covers self-hosted installations.

Workaround

  • Limit media upload rights to trusted roles, or disable HTML file uploads if possible (confirm the setting with Shopware before changing production).
  • Reduce admin accounts with extension-management (plugin install/activation) rights.
  • Restrict admin panel access to VPN or IP allowlists.

Exploitation

  • No exploitation in the wild has been confirmed.
  • No public proof-of-concept has been confirmed.
  • CISA SSVC: Exploitation none, automatable yes, technical impact total.
  • EPSS about 0.28% according to a third-party aggregator; not verified on CISA KEV.

Our recommendation

  • Contact Shopware to confirm patch status for your version and whether the PaaS maintenance applies to you.
  • Audit which admin users can upload media and which hold plugin rights; remove unneeded rights.
  • Search media folders for .html/.htm files and review unexpected ones.
  • Review plugin install and activation logs.
  • Instruct administrators not to open unknown media links while logged into the admin panel.
  • Restrict admin access to trusted networks.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:41.

Original description (NVD)

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token. The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed