VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

CVE-2026-104937 is a stored XSS vulnerability in Shopware 6.7's media upload API, which accepts HTML files served as text/html without proper Content-Security-Policy or X-Content-Type-Options headers. An attacker with media upload capability can upload malicious HTML containing JavaScript. When an administrator accesses the malicious media URL, the script can exfiltrate the administrator's authentication token, enabling unauthorized API access. With extension management privileges, the attacker can install malicious plugins to execute arbitrary PHP code on the server with Shopware process privileges. CERT/CC was unable to coordinate disclosure with Shopware, and no patch is currently available.

An attacker with media upload access can execute arbitrary JavaScript in an administrator's browser context, steal valid administrator authentication tokens, and gain privileged access to the Shopware Administration API. This can lead to unauthorized administrative actions. If the compromised administrator account has extension management privileges, the attacker can achieve remote code execution on the underlying operating system with Shopware process privileges by uploading and activating malicious plugins.

No official patch or vendor advisory is currently available. Users should reduce risk by limiting media upload functionality to trusted roles only or disabling HTML file uploads entirely to prevent attackers from uploading malicious browser-executable content. Monitor for suspicious activity related to media uploads and administrator access until a patch is released.