CVE-2026-104937

Deferred Deferred - Pending Action

Stored XSS in Shopware via Malicious HTML Upload

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: CERT/CC

Description

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token. The compromised token enables unauthorized access to the Shopware Administration API. If the affected administrator account possesses extension‑management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104937

EUVD

EUVD-2026-99209

Affected Vendors & Products

Vendor	Product	Version / Range
Shopware	Shopware	6.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Shopware version 6.7. It allows attackers with media upload access to upload malicious HTML files containing JavaScript code. When an administrator views the uploaded file, the embedded script executes in the administrator's browser context, enabling theft of authentication tokens.

Detection Guidance

Check for recently uploaded HTML files in the Shopware media directory. Review server logs for unusual file uploads or administrator sessions accessing unknown files. Inspect network traffic for unauthorized API calls from the Shopware Administration interface.

Impact Analysis

The stolen authentication token grants unauthorized access to the Shopware Administration API. If the compromised account has extension management privileges, attackers can upload and activate malicious plugins, leading to arbitrary PHP code execution on the server with Shopware process privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements if personal data is exposed. For HIPAA, it risks compromising protected health information if the Shopware instance handles such data, potentially leading to breaches of confidentiality and integrity requirements.

Mitigation Strategies

Restrict media upload permissions to trusted roles only. Disable HTML file uploads entirely. Monitor administrator accounts for suspicious activity. Consider disabling extension management privileges for affected accounts until a patch is available.

Hi! I’m here to help you understand CVE-2026-104937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70