CVE-2026-62990

Name of the Vulnerable Software and Affected Versions Shopper versions 2.0.0 through 2.10.0 Shopper versions 3.0.0-beta.1 through 3.0.0-beta.2

Description Authenticated back-office staff with content-upload permissions can store executable media on the administrator's origin. In the 2.x implementation, permissions such as edit products or add brands allow the upload of image/svg+xml via packages/admin/config/media.php. Additionally, the product files collection in packages/admin/src/Livewire/Components/Products/Form/Files.php lacks MIME restrictions and accepts text/html. Because media is served inline from the /storage/ directory without a Content-Security-Policy or Content-Disposition: attachment, opening these files executes stored scripts in the administrator's session. In 2.x, this can be used to call the store() function within packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php, which trusts the client-supplied role id to create a new administrator account with a chosen password. This allows an attacker to gain full access to customer data, orders, settings, and user management. In 3.x prereleases, while SVG is excluded, executable product files are still permitted.

Recommendations Update Shopper versions 2.0.0 through 2.10.0 to version 2.10.1. Update Shopper versions 3.0.0-beta.1 through 3.0.0-beta.2 to version 3.0.0-beta.3.