A stored cross-site scripting flaw in Shopware 6.7, designated CVE-2026-104937, has been disclosed by CERT/CC. The vulnerability could allow an attacker with media upload rights to plant a malicious HTML file that is later served as a page without essential browser security headers.
When an administrator clicks the link to the malicious file, the embedded script can steal the admin’s login token, enabling the attacker to access the Shopware Administration API and, if the admin also has extension management rights, install a malicious plugin. CERT/CC notes this could lead to arbitrary PHP code execution on the server with the privileges of the Shopware process.
The advisory explicitly states no patch had been released at the time of the report and that CERT/CC had not been able to coordinate with Shopware on a fix.
Affected versions are listed as Shopware 6.7. The exploitation status is described as unconfirmed in the wild, with no public proof-of-concept available at the time of publication. Stores that allow staff, vendors or partners to upload media are most at risk, particularly where admins also hold extension management rights, which could elevate token theft to full server compromise.
Practical mitigations recommended by CERT/CC include restricting media upload access to trusted roles only and disabling HTML file uploads entirely, along with limiting who can manage extensions and instructing admins to avoid opening unfamiliar media links. A firm vendor advisory is awaited. The report cites CERT/CC vulnerability note VU#157374 in explaining the chain from stored XSS to admin credential compromise and potential remote code execution.