Shopware 6.7 stored cross-site scripting can steal admin tokens and lead to remote code execution (CVE-2026-104937)

What happened

Shopware 6.7 allows an attacker-controlled HTML file to be uploaded and served as text/html without effective security headers. This creates a stored cross-site scripting condition. The CVE record rates the flaw high severity with a CVSS 3.1 score of 8.1: the attack vector is the network, no privileges are required, but user interaction is required, and the impact is high for confidentiality and integrity.

If an administrator views the malicious file, embedded JavaScript can read and exfiltrate the administrator's authentication token. The stolen token can then be used against the Shopware Administration API.

Where the compromised administrator account has extension-management privileges, the attacker can upload, install and activate malicious plugins to achieve arbitrary PHP code execution on the underlying operating system with the privileges of the Shopware process. The CVE record lists no active exploitation and no public disclosure.

Who is affected

The CVE record lists Shopware 6.7 as affected. No fixed version is listed, and the CVE record contains no vendor fix or workaround. Shopware is a shop platform that is typically internet-facing; teams running or hosting a Shopware 6.7 store should treat the administration interface and file upload paths as in scope.

What to do now

1. Restrict access to the Shopware Administration interface to trusted networks or a VPN, and do not expose it directly to the public internet.
2. Restrict or disable HTML file uploads where possible. If uploads are required, allow only trusted users and inspect existing upload storage for suspicious HTML files.
3. Review Shopware Administration API activity for unexpected plugin upload, installation or activation events, especially outside change windows.
4. Watch the Shopware vendor channel for a fixed release and apply it when published. No fixed version or workaround is listed yet.

How to detect it

Review Shopware Administration API logs for unexpected plugin upload, installation or activation events, especially for administrator sessions from unusual locations. Check upload storage for HTML files that are served with a text/html content type. The CVE record does not provide specific indicators of compromise.

Beyond the patch

Because Shopware shops are public-facing and no fix is listed yet, the useful work is to verify how the shop is deployed and how uploads are governed. A penetration test and hardening review can test whether untrusted HTML uploads reach the administration interface and whether the Shopware Administration API is exposed (Implementation & Assessment Services). Exposure management can identify public administration endpoints and other reachable services (Virtual CISO Services (vCISO)). Since the patch cycle is currently open, tracking Shopware as a software supplier and its update behaviour is part of third-party risk management (Supply Chain Defense & Third-Party Risk).