CVE-2026-104937: Shopware 6.7 Stored XSS Vulnerability

CVE-2026-104937 Overview

CVE-2026-104937 affects Shopware version 6.7, an open-source e-commerce platform. The application accepts attacker-controlled HTML file uploads and serves them with a text/html content type without effective security headers. This behavior enables stored cross-site scripting (XSS) when an administrator views the uploaded file. The embedded JavaScript payload executes in the administrator's browser context and exfiltrates the authentication token used for the Shopware Administration API.

Critical Impact
An attacker who obtains an administrator token with extension-management privileges can upload, install, and activate a malicious plugin. This leads to arbitrary PHP code execution on the host under the Shopware process account.

Affected Products

Shopware 6.7
Shopware Administration API (token-authenticated access)
Shopware extension/plugin management subsystem

Discovery Timeline

2026-10-13 - CVE CVE-2026-104937 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104937

Vulnerability Analysis

The root issue is a stored XSS condition [CWE-79] combined with insecure file-serving behavior. Shopware 6.7 allows users to upload HTML files and returns them with the text/html MIME type. The responses do not include effective hardening headers such as Content-Security-Policy, Content-Disposition: attachment, or X-Content-Type-Options: nosniff enforcement that would neutralize script execution.

When an administrator opens the uploaded resource in the same browser session used for the admin panel, embedded JavaScript runs with access to admin-origin storage. The payload reads the administration authentication token and transmits it to an attacker-controlled endpoint. The attacker then authenticates to the Shopware Administration API as that administrator.

If the compromised account holds extension-management rights, the attacker uses the API to upload and activate a malicious plugin. Shopware plugins execute PHP server-side, so plugin activation yields arbitrary PHP execution. This escalates a client-side XSS into full remote code execution on the underlying operating system with the privileges of the web process.

Root Cause

The vulnerability stems from two compounding defects. First, the upload handler does not restrict or transform active content types such as HTML. Second, the delivery layer serves these files inline with text/html and omits headers that would prevent script execution. Together, they create a reliable stored XSS primitive.

Attack Vector

The attack requires an authenticated upload capability and a victim administrator who views the uploaded file. The attacker uploads an HTML document containing JavaScript, waits for or lures an administrator to open it, exfiltrates the admin token, and then calls the Administration API to install a malicious plugin for code execution. Full technical details are available in the CERT Vulnerability Note #157374.

Detection Methods for CVE-2026-104937

Indicators of Compromise

Uploaded files served with Content-Type: text/html from Shopware media endpoints, especially files with .html, .htm, or .svg extensions originating from untrusted users.
Outbound HTTP requests from administrator browsers to unknown domains shortly after opening a media asset, consistent with token exfiltration.
Administration API calls to plugin upload, install, or activate endpoints originating from unfamiliar IP addresses or user agents.
New or unknown plugins appearing in the Shopware extension manager, particularly plugins installed outside normal change-management windows.

Detection Strategies

Inspect Shopware media directories for stored HTML or SVG files containing <script> tags, event handlers such as onload=, or references to fetch(, XMLHttpRequest, and document.cookie.
Monitor web server access logs for GET requests to /media/ paths returning text/html responses.
Alert on Administration API sessions where token issuance IP and subsequent API usage IP differ within a short window.
Review PHP process execution and file writes under the Shopware installation path for unexpected plugin directories or shell-like files.

Monitoring Recommendations

Enable detailed Administration API audit logging and forward it to a centralized analytics platform for correlation with upload and plugin-install activity.
Monitor the custom/plugins/ directory for new files and track plugin lifecycle events (install, activate, update).
Baseline normal administrator browser egress destinations and alert on anomalous outbound domains contacted during admin sessions.

How to Mitigate CVE-2026-104937

Immediate Actions Required

Apply the Shopware security update for 6.7 as soon as the vendor patch is available. Track the CERT Vulnerability Advisory #157374 for fixed versions.
Audit the Shopware media library for user-uploaded HTML, HTM, and SVG files and remove or quarantine any that cannot be attributed to a trusted source.
Review installed plugins and remove any that were not deployed through an approved change process. Rotate all Administration API tokens and admin credentials.
Restrict extension-management privileges to a minimal set of administrator accounts.

Patch Information

At the time of publication, vendor patch references are tracked through the CERT Vulnerability Note #157374. Administrators should consult the Shopware security advisories channel for the fixed 6.7 release and apply it to all production and staging environments.

Workarounds

Configure the web server (for example, Nginx or Apache) in front of Shopware to force Content-Disposition: attachment and X-Content-Type-Options: nosniff on responses from media upload paths.
Add a strict Content-Security-Policy response header to media endpoints that disallows inline scripts and restricts script sources.
Block upload of .html, .htm, .svg, and other active-content file types at the application or reverse-proxy layer until the patch is applied.
Serve user-uploaded media from a separate origin (distinct domain) so that any script execution cannot access administration-session cookies or tokens.

bash

# Nginx example: force download and disable script execution for Shopware media
location ^~ /media/ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox;" always;
    types { } default_type application/octet-stream;
}