Is CVE-2026-104937 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104937 being exploited in the wild.

How severe is CVE-2026-104937?

Informational severity, published 13 October 2026.

Is there a fix for CVE-2026-104937?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-104937 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104937?

Check whether you run Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104937: Shopware stored XSS in media upload via missing security headers

CVE-2026-104937 · Severity: info · Published 2026-10-13

Shopware 6.7, an open-source e-commerce platform, allows users with media upload privileges to upload HTML files containing malicious JavaScript code. When an administrator views such a file, the attacker's script executes and steals the administrator's authentication token, enabling unauthorized access to the admin API. If that administrator can manage extensions, the attacker can upload and activate malicious plugins to run arbitrary code on the server.

Technologies: Shopware. Vendors: Shopware.

Quick answers

Is CVE-2026-104937 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104937 being exploited in the wild.
How severe is CVE-2026-104937?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Shopware 6.7.
Is there a fix for CVE-2026-104937?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104937 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104937?: Check whether you run Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS vulnerability exists in Shopware's media upload functionality where HTML files are served as text/html without Content-Security-Policy or X-Content-Type-Options security headers. An attacker with media upload access can inject JavaScript that executes in an administrator's browser context when the file is accessed, allowing token theft and subsequent API abuse. If combined with extension-management privileges, this leads to arbitrary PHP code execution on the underlying system.

Affected products

Shopware Shopware 6.7

Timeline

2026-10-13: disclosed
2026-09-08: other: Vendor notified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.