Unpatched XSS flaw in Shopware 6.7 hits the media manager

How the attack works

The media manager in Shopware 6.7 accepts files whose content the attacker controls and then serves them with the content type text/html. Effective security headers are missing. If someone with an active admin session opens such a file in the browser, the embedded code runs in the context of the shop domain and can read the authentication token.

With that token, the Admin API is open. It allows extensions to be installed, which in practice amounts to code execution on the server. The CERT Coordination Center tracks the case as VU#157374 and states that Shopware was notified on 8 September 2026.

The entry point is part of the standard shop installation. Any account with upload rights qualifies, including editorial logins, agency accounts and import integrations.

The patch situation is open

No specific fix version for self-managed installations is named in the public entries so far. According to the CVE record, the 6.7 line is affected. Whether the 6.6 line is vulnerable as well does not follow from the available information. The severity rating is inconsistent too, and a completed NVD analysis is not available.

On its own status page, Shopware reports a security measure for this CVE on PaaS Native for 15 October 2026. Anyone hosting the shop themselves has to take care of the mitigation.

The last regular security release was 6.7.14.1 on 16 September 2026. The service releases 6.7.15.1 and 6.6.10.29 from 7 October 2026 bring corrections for the Rule Builder and for unused themes. Based on the current sources, they do not contain a fix for CVE-2026-104937.

Mitigation without a patch

The mitigation sits on the delivery side. As long as media files are never rendered as HTML in the browser, the described route leads nowhere. This can be enforced at web server level, independently of the Shopware release.

• Block uploads of.html.htm and.svg in the media manager

• Serve media with Content-Disposition: attachment

• Set X-Content-Type-Options and a restrictive CSP for the media directory

• Ideally serve media from a separate domain or a CDN

• Search existing media folders for HTML files

• Take stock of upload permissions, integrations and API keys, and withdraw surplus admin rights

What this means for your shop

Update to 6.7.15.1 or 6.6.10.29, because that is the maintained state. Schedule the maintenance window for the upcoming security release now, and watch the Shopware security advisories on GitHub for it. A major version jump is not needed at the moment. Version 6.7 has security support until 28 February 2028, and so does 6.6.

When updating to 6.7.15.1, take a look at your own mail templates. The GARAN labels now arrive as template data. Also check the PHP version. Versions 6.6 and 6.7 run on PHP 8.2 up to 8.5, and PHP 8.5 is officially supported from 6.7.7 onwards. The SQL injection in the Store API from September explicitly affected installations on PHP 8.4.

For agency teams, the browser is the actual point of attack. The admin session runs in Safari or Chrome on a staff member's Mac. A dedicated browser profile for shop admins and consistent logout at the end of the working day noticeably shrink the window for token theft. We advise against patching the core yourself and against a rushed migration.