CERT/CC: VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

CERT/CC published a security advisory titled “VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE”.

At a glance

Publisher

CERT/CC

CVEs

CVE-2026-104937

What the advisory says

Overview Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It provides merchants with customizable product pages, administrative interfaces, plugin functionality, and a media management system that allows users to upload and serve files. CVE-2026-104937 In affected versions, Shopware’s media upload API accepts HTML files that are later served as text/html without effective Content-Security-Policy or X-Content-Type-Options security headers. An attacker with access to the media upload capability can therefore upload an HTML file with malicious embedded JavaScript, and if an administrator opens the corresponding media URL, the attacker can exfiltrate the admin

What should you do?

• Read the full vendor advisory linked below and confirm whether you run affected versions.
• Schedule the recommended update, prioritising internet-facing systems.
• Watch for exploitation reports; unpatched edge devices are frequent targets.

Background: Token theft

Revoke the compromised token immediately. Terminate all active sessions for the affected identity. Rotate associated API keys and secrets. Audit recent actions for data exfiltration. Reset multi-factor authentication bindings. Monitor logs for anomalous behavior from related accounts to detect lateral movement.

Read the full guide: Token Theft Response: Containment, Revocation, and Recovery Steps

What to do and how to stay safe: CVE-2026-104937

• Vulnerability severity scores ignore your specific architecture and context.
• Exploitability depends on network exposure and user behavior, not just code flaws.
• Prioritization requires continuous asset inventory and threat intelligence alignment.

Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.