Shopware 6.7 XSS flaw in media uploads enables admin token theft
Best suited for
- Seniority
- Analyst
- Job function
- Cybersecurity / Information Security
- Persona
- Security Operations Practitioner
- Buyer role
- Technical Implementer / Administrator
- Decision stage
- Post Buy
- Adoption curve
- Early Majority
- Technology maturity
- Established Technology
- Industry
- Information Technology / Software & Services / Internet Software & Services / E-Commerce Platforms
Our classification, not the publisher's statement. Best suited for, not only for.
Shopware 6.7 contains a stored cross-site scripting flaw in its media upload functionality. Successful exploitation can lead to compromise of administrator credentials and remote code execution.
The flaw is tracked as CVE-2026-104937. In affected versions, the media upload API accepts HTML files and later serves them as text/html, without effective Content-Security-Policy or X-Content-Type-Options security headers. A user with media upload capability can submit an HTML file containing embedded malicious JavaScript. When an administrator opens the corresponding media URL, the script can exfiltrate that administrator's authentication token, which can then be used to access the Shopware Administration API without authorization.
Exploitation could allow an attacker with media creation or upload access to run arbitrary JavaScript in the administrator browser context, steal valid administrator authentication tokens, and gain privileged access to the Administration API. Where the affected administrator account holds extension management privileges, the attacker could upload, install, and activate malicious plugins, achieving arbitrary PHP code execution on the underlying operating system with the privileges of the Shopware process.
The CERT/CC was unable to reach Shopware to coordinate this vulnerability. Until a patch is available, users can reduce risk by restricting access to the media upload functionality to trusted roles, or by disabling HTML file uploads entirely, which prevents attackers from creating malicious content that browsers interpret.
Deflask13 is credited with researching and reporting the vulnerability, and Molly Jaconski wrote the document. Publication records list the public date and first publication date as 2026-10-13, with the last update at 18:14 UTC on the same day under document revision 1. One or more vendors are listed, and readers are directed to the full report for vendor details.
Blog post, originally published by Molly Jaconski at kb.cert.org.