Unpatched Shopware Flaw CVE-2026-104937 Turns Stored XSS Into Admin Takeover and RCE
Do Son 
TL;DR
CERT/CC disclosed CVE-2026-104937 on October 13, 2026, a stored XSS flaw in Shopware 6.7. The Shopware vulnerability can lead to stolen admin tokens and remote code execution. No patch exists yet.
- CVE: CVE-2026-104937
- CVSS: Awaiting analysis
- Product: Shopware
- Affected: 6.7
- Impact: CVE-2026-104937
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Why It Matters
Shopware powers online stores, so a breach can expose customer and order data. According to CERT/CC vulnerability note VU#157374, the bug “can lead to administrator credential compromise and remote code execution.”
The disclosure also lacks a fix. CERT/CC states: “Unfortunately, the CERT/CC was unable to reach Shopware to coordinate this vulnerability.”
How the Attack Works
Shopware’s media upload feature accepts HTML files. It then serves them as web pages without key browser security headers. As a result, an attacker with upload rights can plant a malicious HTML file.
When an administrator opens that file’s link, the embedded script steals their login token. With it, the attacker gains access to the Shopware Administration API. If the admin can manage extensions, the attacker can then install a malicious plugin. CERT/CC says this enables “arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process.”
Who is at risk
Stores that let staff, vendors or partners upload media face the most risk. Any account with upload rights can plant the stored XSS file. The danger grows when admins also hold extension management rights, since that turns token theft into full server control.
Exploitation status
No exploitation in the wild has been confirmed. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
CERT/CC lists Shopware 6.7 as affected.
Patch and Mitigation Steps
Until Shopware ships a fix, CERT/CC recommends these steps:
- Limit media upload access to trusted roles only.
- Disable HTML file uploads entirely.
Store owners should also limit who holds extension management rights. In addition, admins should avoid opening unfamiliar media links. Watch for an official update that fixes this Shopware vulnerability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
