Shopware 6.7 has a stored cross-site scripting flaw in its media upload path. Someone allowed to create media can place an HTML file where an administrator might open it; the browser then runs the file’s JavaScript in a context that can expose the administrator’s authentication token. For a store team, the first question is who can upload media and which administrators are likely to review it.
CERT/CC’s October 13 note describes the conditional second step: a stolen token grants access to the Shopware Administration API. If that administrator can manage extensions, the attacker could install and activate a malicious plugin and run PHP code with the privileges of the Shopware process. Researcher Deflask13 reported the vulnerability, tracked as CVE-2026-104937.
An HTML file becomes active content
Media uploads are meant to hold store assets such as product imagery. Here, the upload API accepts HTML and serves the resulting file as text/html. CERT/CC says the response lacks effective Content-Security-Policy and X-Content-Type-Options protection. Opening the media URL in an administrator’s browser gives embedded JavaScript a route to that administrator’s token. The CVE Program’s record describes Shopware 6.7 as affected and repeats the token-to-Administration-API chain.
The attacker needs media creation or upload access first, and an administrator has to open the uploaded file. Extension-management permission determines whether the described token theft could reach the plugin-installation and PHP-execution step. CERT/CC calls out “malicious embedded JavaScript” in an uploaded HTML file.
Identify exposed upload paths
Map the roles and integrations that can create media on each Shopware 6.7 installation, especially accounts used by external catalog staff or automated feeds. Review the media library for HTML uploads and the corresponding administrator access to those media URLs. Treat an unexpected HTML media file and administrator visit as leads for investigation; inspect the store’s media creation records, HTTP access logs and Administration API activity around the same period. A permitted HTML file alone is a format finding, while unusual privileged API or extension-management activity may warrant incident response.
The current CERT/CC vendor entry lists Shopware’s status as unknown and says CERT/CC could not reach the vendor for coordination. CERT/CC advises interim restrictions “until a patch is available.” Keep the interim upload restrictions in place while you follow Shopware release guidance for a fix.
Restrict who creates media
Limit media upload to trusted roles, or disable HTML file uploads entirely, as CERT/CC recommends. Then verify in the store’s role configuration and a controlled upload-permission check that a low-trust media contributor cannot create an HTML media item. Keep administrators away from unexpected uploaded HTML URLs while you review existing media and relevant access history. If investigation finds suspicious use of an administrator token or extension-management actions, handle the affected account and store as a potential compromise rather than stopping at the upload setting.