CVE-2026-49849: xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xShopto a version that resolves this vulnerability.Fixed in 3.0.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated xShop administrator can exploit it through the Admin panel's file attachment module. The issue does not describe exploitation by unauthenticated or lower-privileged users.
Which deployments are affected?
xShop version 3.0.3 is affected. Version 3.0.4 fixes the issue.
What access does exploitation provide?
An attacker who uploads a specially crafted PHP file can execute code remotely on the server. The described impact is full system compromise.