Verified

CVE-2026-104937: Shopware 6.7

Affected technology

Shopware · 6.7
Shopware

Description’s affected range: version 6.7

Component: Not specified by the source

What an attacker can do

The source says when a malicious uploaded file containing an embedded JavaScript payload is viewed by an administrator, the attacker can access and exfiltrate the administrator's authentication token.

Published 13-Oct-2026 20:19 UTC

KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-13 20:16:59.278043+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-104937.html