Shopware media uploads expose admin tokens to stored XSS

Shopware 6.7 accepts HTML through its media upload API and serves the resulting file as text/html without effective browser security headers, according to CERT/CC. If someone with media creation access gets an administrator to open such a file, its JavaScript can take the administrator’s authentication token. That token can grant access to the Shopware Administration API; an administrator with extension-management privileges could also enable malicious plugins and PHP execution under the Shopware process. Researcher Deflask13 reported the issue as CVE-2026-104937.

Identify who can create media on your Shopware stores, including catalog integrations and delegated staff. Review existing HTML media and administrator access to its URLs. For suspicious items, correlate media creation records with HTTP access, privileged API activity and extension changes. An HTML upload is a starting lead; the activity around it determines the response.

Restrict media upload to trusted roles or disable HTML uploads, as CERT/CC recommends. Verify the restriction through the role configuration and a controlled permission check using a low-trust media contributor account. CERT/CC lists the vendor status as unknown and advises these interim measures while a patch is pending. If you find suspicious token or extension activity, investigate the administrator account and store for compromise.