{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/157374#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nShopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution.\r\n\r\n### Description\r\nShopware is an open-source e-commerce platform used to build and manage online stores. It provides merchants with customizable product pages, administrative interfaces, plugin functionality, and a media management system that allows users to upload and serve files.\r\n\r\n**CVE-2026-104937** In affected versions, Shopware’s media upload API accepts HTML files that are later served as `text/html` without effective `Content-Security-Policy` or `X-Content-Type-Options` security headers. An attacker with access to the media upload capability can therefore upload an HTML file with malicious embedded JavaScript, and if an administrator opens the corresponding media URL, the attacker can exfiltrate the administrator's authentication token and use it to gain unauthorized access to the Shopware Administration API. \r\n\r\n### Impact\r\nSuccessful exploitation of this vulnerability could allow an attacker with media creation/upload access to execute arbitrary JavaScript in the administrator browser context, steal valid administrator authentication tokens, and gain privileged access to the Shopware Administration API. If the affected administrator account possesses extension management privileges, an attacker could upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process. \r\n\r\n### Solution\r\nShopware has confirmed that remediations are currently in development. Until a patch is available, users should follow the workaround guidance provided by Shopware linked in the \"References\" section below.\r\n\r\n### Acknowledgements\r\nThanks to Deflask13 for researching and reporting this vulnerability. This document was written by Molly Jaconski.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/157374"},{"url":"https://github.com/github/advisory-database/blob/25531bb249a44038ed082c2e3e48d185e922e621/advisories/unreviewed/2026/10/GHSA-pfh5-g6h6-v95h/GHSA-pfh5-g6h6-v95h.json","summary":"https://github.com/github/advisory-database/blob/25531bb249a44038ed082c2e3e48d185e922e621/advisories/unreviewed/2026/10/GHSA-pfh5-g6h6-v95h/GHSA-pfh5-g6h6-v95h.json"}],"title":"XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE","tracking":{"current_release_date":"2026-10-15T20:38:35+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.50"}},"id":"VU#157374","initial_release_date":"2026-10-13 18:14:01.137020+00:00","revision_history":[{"date":"2026-10-15T20:38:35+00:00","number":"1.20261015203835.3","summary":"Released on 2026-10-15T20:38:35+00:00"}],"status":"final","version":"1.20261015203835.3"}},"vulnerabilities":[{"title":"Shopware versions 6.","notes":[{"category":"summary","text":"Shopware versions 6.6.10.0 and later allow the upload of attacker-controlled HTML files through the media management functionality. Public media files may be served directly by the web server, object storage, or CDN with the `text/html` content type and without an effective Content Security Policy. An authenticated attacker with `media:create` or `media:update` privileges can upload an HTML file containing malicious JavaScript, and if a privileged Administration user opens the resulting media URL, the JavaScript executes under the shop's origin. \r\n\r\nSuccessful exploitation may allow the attacker to compromise the Administration authentication token and perform Admin API operations with the victim's privileges. If the affected account is permitted to upload and activate extensions, the attack could potentially be escalated to arbitrary PHP code execution. Exploitation requires user interaction because a privileged user must open the malicious media URL."}],"cve":"CVE-2026-104937","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#157374"}]}],"product_tree":{"branches":[]}}