CVE-2026-104937 Details

A stored cross-site scripting vulnerability has been identified in Shopware version 6.7. The issue arises in the media upload functionality, where the application allows the upload of HTML files containing malicious JavaScript. These files are served as text/html without proper security headers, such as Content-Security-Policy or X-Content-Type-Options. When an administrator views the uploaded file, the embedded script is executed, allowing the attacker to steal the administrator's authentication token. This token can then be used to gain unauthorized access to the Shopware Administration API. If the compromised account has extension management privileges, the attacker could upload and activate malicious plugins, potentially leading to arbitrary PHP code execution on the server with the same privileges as the Shopware process.

Users can mitigate this vulnerability by restricting access to the media upload feature to trusted roles or by disabling HTML file uploads altogether, preventing the creation of malicious content that can be interpreted by browsers.