CVE-2026-104937: XSS
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token. The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.
Affected Software
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Shopware instances where an attacker can upload HTML files are exposed, particularly when an administrator later views an uploaded malicious file. The impact is highest for administrators with extension-management privileges.
What does an attacker need to exploit it?
The attacker needs a way to upload an attacker-controlled HTML file and must get an administrator to view that file. The uploaded file can contain JavaScript that steals the administrator's authentication token.
What can an attacker do after stealing an administrator token?
The token can be used for unauthorized access to the Shopware Administration API. If the compromised administrator can manage extensions, the attacker can upload, install, and activate a malicious plugin, resulting in arbitrary PHP code execution as the Shopware process.
How can I determine whether exploitation may have occurred?
Review uploaded HTML files and identify whether administrators viewed untrusted uploads. Investigate Administration API activity associated with administrator tokens, especially extension upload, installation, or activation actions that were not expected.