# Shopware 6.7 stored XSS risks admin RCE

Published: 2026-10-13 · Severity: routine · Sectors: retail, technology
Canonical: https://vorant.io/reports/3b35c797-f4ea-54e8-8ee8-1a80b9aa6368/shopware-6-7-stored-xss-risks-admin-rce

> A stored XSS flaw in Shopware 6.7's media upload can let attackers steal admin tokens and potentially achieve RCE via malicious plugins, with no patch yet.

CERT/CC published VU#157374 describing CVE-2026-104937, a stored cross-site scripting vulnerability in Shopware 6.7's media upload functionality. The platform's media API accepts HTML file uploads and serves them as text/html without a Content-Security-Policy or X-Content-Type-Options header, allowing an attacker with media upload access to embed malicious JavaScript in an uploaded file. If an administrator subsequently opens the media URL, the script can exfiltrate the admin's authentication token, giving the attacker access to the Shopware Administration API.

The impact escalates significantly if the compromised administrator account has extension management privileges: an attacker could use the stolen token to upload, install, and activate a malicious plugin, achieving arbitrary PHP code execution on the host with the privileges of the Shopware process. This effectively chains a browser-side XSS into full server compromise of an e-commerce platform.

CERT/CC states it was unable to reach Shopware to coordinate disclosure, so no official patch is currently available. Defenders running Shopware 6.7 should restrict media upload capability to trusted roles only and disable HTML file uploads entirely to prevent attacker-controlled, browser-interpretable content from being served. There is no indication in the advisory of active exploitation in the wild; this is a researcher-reported vulnerability awaiting vendor response.

## Mentioned in this report

- Vulnerabilities: CVE-2026-104937

## Detection guidance (public sample)

### Shopware Media API Upload of Browser-Interpretable HTML/SVG File

ATT&CK: T1190

Detects POSTs to the Shopware Admin API media upload action with an HTML/SVG-type extension, the primitive behind the stored XSS that can steal admin tokens. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shopware Media API Upload of Browser-Interpretable HTML/SVG File
id: 2bec164e-2c49-5a5c-aa2b-d965b439def6
status: experimental
description: Detects POST requests to the Shopware Admin API media upload action (/api/_action/media/{id}/upload)
  where the query string declares an HTML-like extension (html, htm, xhtml, svg).
  Such files are served as text/html without CSP/nosniff and can run script in an
  administrator's browser to steal the admin API token. Generalises on the endpoint
  and extension parameter, not on specific file names or media IDs.
references:
- https://kb.cert.org/vuls/id/157374
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1528
- attack.execution
- attack.t1059.007
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: /_action/media/
    cs-uri-stem|endswith: /upload
    cs-uri-query|contains:
    - extension=html
    - extension=htm
    - extension=xhtml
    - extension=svg
  condition: selection
falsepositives:
- Merchants or designers legitimately uploading SVG images through the Shopware media
  manager
- Theme or integration tooling that uploads SVG assets via the Admin API
level: medium
author: Vorant
```

### Shopware Admin API Plugin Upload, Install or Activate Sequence

ATT&CK: T1190

Detects POST requests to Shopware Admin API extension upload/install/activate actions, the step that turns a stolen admin token into PHP code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shopware Admin API Plugin Upload, Install or Activate Sequence
id: 9e6954ba-ba46-5570-9653-67ee74a27c46
status: experimental
description: Detects POST requests to the Shopware Admin API extension management
  actions (upload, install, activate). After stealing an administrator token via stored
  XSS, an attacker can upload and activate a malicious plugin to execute arbitrary
  PHP on the host. Review source IP, user agent and whether the request follows a
  recent HTML media upload; legitimate plugin management produces the same requests.
references:
- https://kb.cert.org/vuls/id/157374
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1528
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
    - /_action/extension/upload
    - /_action/extension/install/
    - /_action/extension/activate/
  condition: selection
falsepositives:
- Administrators deploying or updating plugins through the Shopware Administration
- CI/CD deployment pipelines that install extensions via the Admin API
level: medium
author: Vorant
```

### Web Server or PHP-FPM Process Spawning Shell With Reconnaissance Commands

ATT&CK: T1190

Detects a PHP/web server process spawning a shell that runs recon or download commands, consistent with a malicious Shopware plugin giving PHP code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP-FPM Process Spawning Shell With Reconnaissance Commands
id: 84d33a2d-af44-5cbb-8d72-4816f0c3c9ac
status: experimental
description: Detects Linux web-facing processes (php-fpm, apache, httpd, nginx) spawning
  a shell whose command line contains common post-exploitation recon or download commands.
  This is the host-level outcome of a malicious plugin installed through a hijacked
  Shopware admin session.
references:
- https://kb.cert.org/vuls/id/157374
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - php-fpm
    - /php
    - apache2
    - httpd
    - nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - id;
    - uname
    - curl
    - wget
    - /etc/passwd
    - /dev/tcp/
    - nc
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications that shell out to curl or wget for legitimate health checks or
  updates
- Hosting control panels running administrative scripts under the web server user
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/157374

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3b35c797-f4ea-54e8-8ee8-1a80b9aa6368/shopware-6-7-stored-xss-risks-admin-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup