Shopware vulnerabilities
CVEs whose affected-version data names the Shopware package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-104937High· 8.1Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS)
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded J…
▾ TwilightShopware · ShopwareEPSS 0.59%via NVD
CVE-2025-67648High· 7.1Shopware is an open commerce platform
Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Tw…
▾ Twilightshopware · shopwareEPSS 0.19%via NVD