Shopware 6.7 contains a stored cross‑site scripting flaw that lets an attacker upload a crafted HTML file. The server serves the file with a text/html MIME type and does not apply content‑security or other headers. When an administrator opens the file, the embedded JavaScript runs in the admin’s browser context. The script can exfiltrate the administrator’s authentication token, allowing the attacker to call the Shopware Administration API. If the compromised administrator has extension‑management privileges, the attacker can upload, install, and activate a malicious plugin, resulting in arbitrary PHP code execution on the host operating system under the privileges of the Shopware process.

All installations of Shopware 6.7 that permit the upload of attacker‑controlled HTML files through the media upload interface and serve the files with a text/html MIME type without security headers remain affected. The upload channel is inferred from the description of the media upload interface in the administration panel, as it is not explicitly documented in the advisory.

The CVSS score of 8.1 indicates a high severity stored XSS vulnerability. The EPSS score of <1 % suggests a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by uploading a malicious HTML file, then requires an administrator to view that file in a browser for the JavaScript to run and exfiltrate the authentication token. With the stolen token the attacker can communicate with the Administration API; if they control an account with extension‑management privileges, they can deploy a malicious plugin that results in arbitrary PHP execution on the underlying system. The likely attack vector is a web‑based stored XSS triggered via the media upload interface in the shop administration area, which is inferred from the advisory text.