VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE
CERT/CC warns a Shopware 6 stored XSS can steal admin tokens and enable code execution, with no patch.
CERT/CC disclosed CVE-2026-104937, a stored XSS flaw in Shopware 6.7 media uploads. The API accepts HTML that is later served as text/html without effective Content-Security-Policy or X-Content-Type-Options headers. An attacker who can upload media can steal an administrator token and, with extension privileges, install a malicious plugin for PHP code execution. CERT/CC could not reach Shopware, so no patch is available.
- Stored XSS in Shopware 6.7 media uploads is tracked as CVE-2026-104937.
- Uploaded HTML is served without effective CSP or X-Content-Type-Options.
- An admin opening the media URL can have their authentication token stolen.
- Privileged admins could then install malicious plugins for PHP code execution.
- No vendor patch; CERT/CC could not reach Shopware to coordinate.
- CVEs
- CVE-2026-104937
- Vendors
- Shopware
- Products
- Shopware 6
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104937 | Stored XSS in Shopware 6.7 can steal admin tokens and lead to RCE | 8.1 | — |
From the original article
1 min read at kb.cert.orgOverview Shopware 6. 7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.