CVE-2026-104937
Shopware 6.7 stored XSS lets attackers steal admin tokens and install malicious plugins (CVE-2026-104937)
Shopware 6.7 allows stored XSS via uploaded HTML files. If an administrator views one, their authentication token can be stolen and used for the Administration API; with extension-management privileges, an attacker can install malicious plugins to execute PHP code. No fixed version is listed.
What happened
Shopware 6.7 allows an uploaded HTML file to be served as text/html without effective security headers, which is stored cross-site scripting (CWE-79). The CVE record rates this high with a CVSS 3.1 score of 8.1. The attack is network-based and, according to the vector, requires no privileges, but it does require a user to view the file, specifically an administrator.
When an administrator views the malicious file, embedded JavaScript can access and exfiltrate the administrator's authentication token. An attacker can then use that token for unauthorised access to the Shopware Administration API.
If the compromised administrator account has extension-management privileges, that API access can be used to upload, install, and activate malicious plugins. That leads to arbitrary PHP code execution on the underlying operating system with the privileges of the Shopware process. Exploitation is not reported as active, and the flaw is not listed as publicly disclosed.
Who is affected
Shopware 6.7 is the version named in the CVE record. No other affected versions are listed, and no fixed release is listed. Shopware is an e-commerce platform, so affected installations are typically public online shops.
What to do now
- Confirm whether any of your shops run Shopware 6.7.
- Treat the administration area and file-upload handling as high risk. No fixed version or vendor workaround is listed in the CVE record, so do not assume an upgrade closes CVE-2026-104937.
- Limit exposure of the Shopware administration interface and review which administrator accounts hold extension-management privileges.
- Monitor upload locations for unexpected HTML files served as text/html, and monitor administration sessions for unfamiliar activity, until Shopware publishes concrete guidance.
How to detect it
No vendor indicators of compromise are published in the CVE record. Because the first stage is an uploaded HTML file, review upload locations for unexpected HTML files that are served as text/html. For administrator accounts with extension-management privileges, look for unrecognised logins, unfamiliar token use, or newly installed plugins. Any of those would warrant investigation in the context of this flaw.
Beyond the patch
Shopware is a public shop platform, so the initial weakness is exactly what a penetration test and hardening review covers: how file uploads are handled and whether content is served with effective security headers. Because no fixed version is listed yet, Shopware's patch cycle is your exposure window — track which Shopware versions you run and how the vendor responds as a supply-chain risk management issue.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Shopware | 6.7 | No fixed version listed yet |