Shopware 6.7 media upload flaw can hand attackers the admin, fix unclear

Shopware 6.7 media upload flaw can hand attackers the admin, fix unclear

13 October 2026: CERT/CC has published a vulnerability note, VU#157374, warning that Shopware 6.7 contains a stored cross-site scripting flaw, CVE-2026-104937, in its media upload function that can lead to an administrator's account being taken over and, in some set-ups, code execution on the server. CERT/CC first said it was unable to reach Shopware; its updated note of 15 October says Shopware has confirmed that a fix is in development and points to Shopware's workaround guidance. We have found no advisory that names a fixed version.

Not yet independently verified. Shopware 6.7.16.0 of 2 November 2026 adds a Content-Security-Policy for uploaded HTML and SVG files on Apache that looks like a mitigation, but its notes do not name this CVE and we found no Shopware advisory or fixed version for it. CERT/CC's page did not load for us. We will update this when it can be confirmed, and remove this note.

Update, 10 November 2026: Shopware 6.7.16.0, released on 2 November, lists a Content Security Policy for static HTML and SVG assets on Apache among its critical fixes. The release notes do not name CVE-2026-104937 and do not mention Nginx. Deployed .htaccess files have to be merged by hand to pick up the change, so check your server configuration after upgrading.

How the flaw works

Shopware's media upload API accepts HTML files and later serves them as text/html without an effective Content-Security-Policy or X-Content-Type-Options header. Someone with permission to upload media can therefore upload an HTML file containing malicious JavaScript. If an administrator opens that file's media URL, the script runs in the administrator's browser and can send their authentication token to the attacker, who can then use the Shopware Administration API with the administrator's rights.

The damage depends on that account. If the administrator can manage extensions, the attacker can upload, install and activate a malicious plugin and run arbitrary PHP code on the server with the privileges of the Shopware process.

Who is exposed

Shopware is an open-source e-commerce platform used to build and manage online shops. The attack needs media upload access, so the risk is highest for shops where many people or integrations can upload media: agencies managing content, marketplace sellers, content editors with broad roles, or any account whose credentials have leaked. CERT/CC notified Shopware on 8 September, published on 13 October and updated the note on 14 October, and it has received no vendor statement.

Reducing the risk until there is a fix

CERT/CC's advice is to limit access to media upload to trusted roles, or to disable HTML file uploads entirely, so that no browser-interpretable content can be created through the media manager. Shop operators can also serve the media folder with a restrictive Content-Security-Policy and an X-Content-Type-Options: nosniff header at the web server or CDN, review which accounts hold upload and extension-management rights, and check the media library for HTML files nobody expects. Our shopping cart software category lists 18 products.

Related on TrustList:

• Takeovers with dates: Pinewood.AI changed hands on 9 October, BASE tender closed on 21 October, Plurilock votes on 18 November
• Coveo buys Anglera to fill gaps in ecommerce product data
• Indonesia warns seven digital services to register by 1 October, with sanctions that can end in blocking; Shopify commits to register

Sources

• CERT/CC: VU#157374, Shopware 6.7 stored XSS in media upload, 13 October 2026
• CERT/CC VU#157374, revision 3, 15 October 2026
• Shopware: release 6.7.16.0 on GitHub, 2 November 2026