CVE-2026-104937

Name of the Vulnerable Software and Affected Versions Shopware version 6.7

Description Shopware allows the upload of attacker-controlled HTML files which are served as text/html without effective security headers, such as Content-Security-Policy or X-Content-Type-Options: nosniff. This leads to stored cross-site scripting (XSS) when an administrator views the uploaded file, allowing the attacker to exfiltrate the administrator's authentication token. This compromised token provides unauthorized access to the Shopware Administration API. If the administrator account has extension-management privileges, an attacker can upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying operating system with the privileges of the Shopware process. The attack occurs via the media upload API.

Recommendations Restrict media upload permissions to trusted users only. Configure a WAF rule to block uploads of .html and .htm files to the media endpoint. Enforce X-Content-Type-Options: nosniff at the reverse proxy level.