Shopware 6.7 media upload flaw can hand attackers the admin, no patch yet

Shopware 6.7 media upload flaw can hand attackers the admin, no patch yet

13 October 2026: CERT/CC has published a vulnerability note, VU#157374, warning that Shopware 6.7 contains a stored cross-site scripting flaw, CVE-2026-104937, in its media upload function that can lead to an administrator's account being taken over and, in some set-ups, code execution on the server. CERT/CC says it was unable to reach Shopware to coordinate a fix, and no patch is available.

Not yet independently verified. CERT/CC says it could not reach Shopware and no vendor statement or fixed version exists; the affected version range beyond "Shopware 6.7" is not given. We will update this when it can be confirmed, and remove this note.

How the flaw works

Shopware's media upload API accepts HTML files and later serves them as text/html without an effective Content-Security-Policy or X-Content-Type-Options header. Someone with permission to upload media can therefore upload an HTML file containing malicious JavaScript. If an administrator opens that file's media URL, the script runs in the administrator's browser and can send their authentication token to the attacker, who can then use the Shopware Administration API with the administrator's rights.

The damage depends on that account. If the administrator can manage extensions, the attacker can upload, install and activate a malicious plugin and run arbitrary PHP code on the server with the privileges of the Shopware process.

Who is exposed

Shopware is an open-source e-commerce platform used to build and manage online shops. The attack needs media upload access, so the risk is highest for shops where many people or integrations can upload media: agencies managing content, marketplace sellers, content editors with broad roles, or any account whose credentials have leaked. CERT/CC notified Shopware on 8 September, published on 13 October and updated the note on 14 October, and it has received no vendor statement.

Reducing the risk until there is a fix

CERT/CC's advice is to limit access to media upload to trusted roles, or to disable HTML file uploads entirely, so that no browser-interpretable content can be created through the media manager. Shop operators can also serve the media folder with a restrictive Content-Security-Policy and an X-Content-Type-Options: nosniff header at the web server or CDN, review which accounts hold upload and extension-management rights, and check the media library for HTML files nobody expects. Our shopping cart software category lists 18 products.

Related on TrustList:

• Takeovers with dates: Pinewood.AI changes hands on 9 October, BASE tender extended to 15 October, Plurilock vote due in November 2026
• Indonesia warns seven digital services to register by 1 October, with sanctions that can end in blocking; Shopify commits to register

Sources

• CERT/CC: VU#157374, Shopware 6.7 stored XSS in media upload, 13 October 2026