Shopware 6.7 stored XSS risks admin RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
A stored XSS flaw in Shopware 6.7's media upload can let attackers steal admin tokens and potentially achieve RCE via malicious plugins, with no patch yet.
CERT/CC published VU#157374 describing CVE-2026-104937, a stored cross-site scripting vulnerability in Shopware 6.7's media upload functionality. The platform's media API accepts HTML file uploads and serves them as text/html without a Content-Security-Policy or X-Content-Type-Options header, allowing an attacker with media upload access to embed malicious JavaScript in an uploaded file. If an administrator subsequently opens the media URL, the script can exfiltrate the admin's authentication token, giving the attacker access to the Shopware Administration API.
The impact escalates significantly if the compromised administrator account has extension management privileges: an attacker could use the stolen token to upload, install, and activate a malicious plugin, achieving arbitrary PHP code execution on the host with the privileges of the Shopware process. This effectively chains a browser-side XSS into full server compromise of an e-commerce platform.
CERT/CC states it was unable to reach Shopware to coordinate disclosure, so no official patch is currently available. Defenders running Shopware 6.7 should restrict media upload capability to trusted roles only and disable HTML file uploads entirely to prevent attacker-controlled, browser-interpretable content from being served. There is no indication in the advisory of active exploitation in the wild; this is a researcher-reported vulnerability awaiting vendor response.
Mentioned in this report
Detection guidance
Shopware Media API Upload of Browser-Interpretable HTML/SVG File
Detects POSTs to the Shopware Admin API media upload action with an HTML/SVG-type extension, the primitive behind the stored XSS that can steal admin tokens. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shopware Media API Upload of Browser-Interpretable HTML/SVG File
id: 2bec164e-2c49-5a5c-aa2b-d965b439def6
status: experimental
description: Detects POST requests to the Shopware Admin API media upload action (/api/_action/media/{id}/upload)
where the query string declares an HTML-like extension (html, htm, xhtml, svg).
Such files are served as text/html without CSP/nosniff and can run script in an
administrator's browser to steal the admin API token. Generalises on the endpoint
and extension parameter, not on specific file names or media IDs.
references:
- https://kb.cert.org/vuls/id/157374
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1528
- attack.execution
- attack.t1059.007
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /_action/media/
cs-uri-stem|endswith: /upload
cs-uri-query|contains:
- extension=html
- extension=htm
- extension=xhtml
- extension=svg
condition: selection
falsepositives:
- Merchants or designers legitimately uploading SVG images through the Shopware media
manager
- Theme or integration tooling that uploads SVG assets via the Admin API
level: medium
author: Vorant
Shopware Admin API Plugin Upload, Install or Activate Sequence
Detects POST requests to Shopware Admin API extension upload/install/activate actions, the step that turns a stolen admin token into PHP code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shopware Admin API Plugin Upload, Install or Activate Sequence
id: 9e6954ba-ba46-5570-9653-67ee74a27c46
status: experimental
description: Detects POST requests to the Shopware Admin API extension management
actions (upload, install, activate). After stealing an administrator token via stored
XSS, an attacker can upload and activate a malicious plugin to execute arbitrary
PHP on the host. Review source IP, user agent and whether the request follows a
recent HTML media upload; legitimate plugin management produces the same requests.
references:
- https://kb.cert.org/vuls/id/157374
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1528
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- /_action/extension/upload
- /_action/extension/install/
- /_action/extension/activate/
condition: selection
falsepositives:
- Administrators deploying or updating plugins through the Shopware Administration
- CI/CD deployment pipelines that install extensions via the Admin API
level: medium
author: Vorant
Web Server or PHP-FPM Process Spawning Shell With Reconnaissance Commands
Detects a PHP/web server process spawning a shell that runs recon or download commands, consistent with a malicious Shopware plugin giving PHP code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or PHP-FPM Process Spawning Shell With Reconnaissance Commands
id: 84d33a2d-af44-5cbb-8d72-4816f0c3c9ac
status: experimental
description: Detects Linux web-facing processes (php-fpm, apache, httpd, nginx) spawning
a shell whose command line contains common post-exploitation recon or download commands.
This is the host-level outcome of a malicious plugin installed through a hijacked
Shopware admin session.
references:
- https://kb.cert.org/vuls/id/157374
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- php-fpm
- /php
- apache2
- httpd
- nginx
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- whoami
- id;
- uname
- curl
- wget
- /etc/passwd
- /dev/tcp/
- nc
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications that shell out to curl or wget for legitimate health checks or
updates
- Hosting control panels running administrative scripts under the web server user
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/157374
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs