Shopper: Stored XSS via SVG and HTML uploads enables administrator creation
Summary
Shopper is a headless e-commerce admin panel for Laravel. Authenticated back-office staff with product or brand upload rights can store SVG or HTML files that run script when an administrator opens them, because media is served inline from the same origin. The script can create a persistent administrator account with a chosen password, giving access to customer data, orders, settings and user roles. Exploitation requires an administrator to open the malicious file.
Affected
- Shopper 2.0.0 up to 2.10.0 (before 2.10.1)
- Shopper 3.0.0 prereleases beta.1 and beta.2 (before 3.0.0-beta.3)
Fixed in
- Shopper 2.10.1
- Shopper 3.0.0-beta.3
Workaround
Unknown.
- Remove image/svg+xml from the media configuration and restrict HTML and executable uploads at the web server or storage layer.
- Serve /storage/ media with Content-Disposition: attachment and a restrictive Content-Security-Policy.
Exploitation
- Exploitation requires an authenticated user with edit_products or add_brands rights and an administrator who opens the uploaded file.
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public proof-of-concept known at the time of writing.
Our recommendation
- Update Shopper to 2.10.1 or 3.0.0-beta.3 (or a newer stable release) and check that the published config/shopper/media.php has been updated by hand.
- Limit upload permissions to the staff who need them.
- Review administrator accounts and recent uploads for unexpected entries, and remove any unknown accounts.
- Restrict access to the admin panel to trusted networks or VPN where possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vmvv-x5cp-2qv6 github.com
- Shopper release v2.10.1 github.com
- Shopper release v3.0.0-beta.3 github.com
- Fix commit 12be681 (block executable uploads) github.com
- Fix commit ad2c5b9 (restrict product files collection) github.com
- Pull request #595 github.com
- Pull request #597 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:15.
Original description (NVD)
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant upload permissions include `edit_products` or `add_brands`, and `packages/admin/config/media.php` allows `image/svg+xml` in every media collection, including image fields whose image/* validation also accepts SVG. The product files collection in `packages/admin/src/Livewire/Components/Products/Form/Files.php` has no MIME restriction and accepts `text/html` as well. Media is served inline from the `public` disk under `/storage/` with its own content type, without `Content-Disposition: attachment` or a `Content-Security-Policy`. When an administrator opens an uploaded HTML or SVG file, stored script executes in that administrator's session. In 2.x, the script can invoke `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, whose `store()` checks `access_setting` held by the viewing administrator but trusts client-supplied `role_id`, to create a new attacker-controlled administrator with a chosen password. This account persists after the uploaded file is deleted and gives access to customer data, orders, settings, and user/role management; the same script can exfiltrate data or grant permissions to the attacker's account. Direct account creation by the low-privileged uploader is blocked, so exploitation requires the administrator to open the file. The 3.x prerelease line already excludes SVG but still allows executable product files. This issue is fixed in versions 2.10.1 and 3.0.0-beta.3.
NVD references (8)
- https://github.com/shopperlabs/shopper/commit/12be681db5f603a364d5f03f1974ff2a20e99b99
- https://github.com/shopperlabs/shopper/commit/ad2c5b9b968ff49c37130c6b9d1dba7f20eebbf6
- https://github.com/shopperlabs/shopper/compare/v3.0.0-beta.1...v3.0.0-beta.3
- https://github.com/shopperlabs/shopper/pull/595
- https://github.com/shopperlabs/shopper/pull/597
- https://github.com/shopperlabs/shopper/releases/tag/v2.10.1
- https://github.com/shopperlabs/shopper/releases/tag/v3.0.0-beta.3
- https://github.com/shopperlabs/shopper/security/advisories/GHSA-vmvv-x5cp-2qv6
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.