Executive brief
Shopper is a Laravel-based e-commerce product management framework. The Media component handles product image uploads and gallery management in the admin panel. Due to a missing authorization check, staff members with read-only product access can modify product images and thumbnails, allowing defacement or substitution of product photos without proper audit trails or permission validation.
Technical details
A missing $this->authorize('edit_products') call in the Media.php store() method (lines 64–76) allows privilege escalation via Livewire RPC. The vulnerable component accepts authenticated requests from staff holding browse_products permission and updates product media fields via $this->product->update($this->form->getState()) without verifying edit_products capability. Although the $product property is server-side locked (preventing arbitrary product targeting), the permission gate is entirely absent. An attacker must be an authenticated admin-panel user and must have previously loaded the target product's edit page in their session (to capture the Livewire snapshot), but the exploit itself is trivial: a single POST to /shopper/livewire/update with the stored snapshot and a call to store(). This is a regression from an incomplete prior patch (GHSA-h4mp-g9c6-xwph) that fixed five sibling sub-form components but omitted Media from the remediation list.
Affected products
- ShopperLabs Shopper < 2.9.2
Timeline
- 2026-06-22: disclosed: Vulnerability published by ShopperLabs on GitHub
- 2026-09-11: advisory: GitHub Advisory Database entry created (GHSA-99h5-jhh7-v3r3)
- 2.9.2: patched: Fix released in version 2.9.2 (adds authorize() call)