CVE-2026-104937

Shopware 6.7 lets an attacker upload HTML that the store then serves as text/html without effective security headers, which is a stored cross-site scripting flaw. If an administrator opens that file, script in the upload can read and steal the administrator’s authentication token. With that token the attacker can call the Shopware Administration API without authorization, and if the account can manage extensions they can install and activate a malicious plugin to run arbitrary PHP as the Shopware process. Shopware 6.7 e-commerce installations are affected. There is no known public proof-of-concept and no listing in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Treat Shopware 6.7 as vulnerable until the vendor publishes a fixed release, then upgrade to that release; the CVE data does not name a patched version. Until then, restrict media and file uploads to trusted staff, avoid opening untrusted uploaded HTML as an administrator, and review Administration API tokens, admin sessions, and recently uploaded, installed, or activated plugins for abuse.