VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Imported from official source

October 13, 2026 18:14 Advisory

Cybersecurity Open Source Classified by Officially

Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Shopware is an open-source e-commerce platform used to build and manage online stores. …

This is an extract. The publication continues at the source.

Read the original at the source: https://kb.cert.org/vuls/id/157374

Officially imported this from CERT Coordination Center’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.

Provenance

Organization: CERT Coordination Center — imported from official source
Official source: https://www.kb.cert.org/vuls/atomfeed/ ATOM
Imported: October 13, 2026 19:00
Versions: 1 recorded
Identity: https://kb.cert.org/vuls/id/157374