{"vuid":"VU#157374","idnumber":"157374","name":"XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE","keywords":null,"overview":"### Overview\r\nShopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution.\r\n\r\n### Description\r\nShopware is an open-source e-commerce platform used to build and manage online stores. It provides merchants with customizable product pages, administrative interfaces, plugin functionality, and a media management system that allows users to upload and serve files.\r\n\r\n**CVE-2026-104937** In affected versions, Shopware’s media upload API accepts HTML files that are later served as `text/html` without effective `Content-Security-Policy` or `X-Content-Type-Options` security headers. An attacker with access to the media upload capability can therefore upload an HTML file with malicious embedded JavaScript, and if an administrator opens the corresponding media URL, the attacker can exfiltrate the administrator's authentication token and use it to gain unauthorized access to the Shopware Administration API. \r\n\r\n### Impact\r\nSuccessful exploitation of this vulnerability could allow an attacker with media creation/upload access to execute arbitrary JavaScript in the administrator browser context, steal valid administrator authentication tokens, and gain privileged access to the Shopware Administration API. If the affected administrator account possesses extension management privileges, an attacker could upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process. \r\n\r\n### Solution\r\nUnfortunately, the CERT/CC was unable to reach Shopware to coordinate this vulnerability. Until a patch is available, users can reduce risk by limiting access to the media upload functionality to trusted roles or disabling HTML file uploads entirely, preventing attackers from creating malicious browser-interpretable content. \r\n\r\n### Acknowledgements\r\nThanks to Deflask13 for researching and reporting this vulnerability. This document was written by Molly Jaconski.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":[],"cveids":["CVE-2026-104937"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-10-13T18:14:02.042335Z","publicdate":"2026-10-13T18:14:01.137020Z","datefirstpublished":"2026-10-13T18:14:02.229148Z","dateupdated":"2026-10-13T18:14:01.137016Z","revision":1,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":258}