CVE-2026-62990 in Shopper
Summary
by MITRE • 10/30/2026
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant upload permissions include `edit_products` or `add_brands`, and `packages/admin/config/media.php` allows `image/svg+xml` in every media collection, including image fields whose image/* validation also accepts SVG. The product files collection in `packages/admin/src/Livewire/Components/Products/Form/Files.php` has no MIME restriction and accepts `text/html` as well. Media is served inline from the `public` disk under `/storage/` with its own content type, without `Content-Disposition: attachment` or a `Content-Security-Policy`. When an administrator opens an uploaded HTML or SVG file, stored script executes in that administrator's session. In 2.x, the script can invoke `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, whose `store()` checks `access_setting` held by the viewing administrator but trusts client-supplied `role_id`, to create a new attacker-controlled administrator with a chosen password. This account persists after the uploaded file is deleted and gives access to customer data, orders, settings, and user/role management; the same script can exfiltrate data or grant permissions to the attacker's account. Direct account creation by the low-privileged uploader is blocked, so exploitation requires the administrator to open the file. The 3.x prerelease line already excludes SVG but still allows executable product files. This issue is fixed in versions 2.10.1 and 3.0.0-beta.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified involves a critical stored cross-site scripting flaw within the Shopper headless e-commerce admin panel, affecting version ranges from 2.0.0 up to but not including 2.10.1, as well as specific prerelease versions of the 3.x branch such as beta.1 and beta.2. This security defect allows authenticated back-office staff members who possess content-upload permissions to inject executable media files into the administrator's origin. The root cause lies in insufficient input validation and MIME type restrictions within the application's file upload mechanisms. Specifically, the configuration file located at packages/admin/config/media.php permits image/svg+xml for all media collections, including image fields that utilize an image/* validation rule which inadvertently accepts SVG formats. Furthermore, the product files collection handled by packages/admin/src/Livewire/Components/Products/Form/Files.php lacks any MIME restriction entirely, thereby accepting text/html and other executable content types without adequate sanitization or verification of file contents beyond their declared headers.
The operational impact is severe because these maliciously uploaded files are served inline from the public disk under the /storage/ directory with their respective content types but without setting a Content-Disposition header to force attachment download, nor do they include a Content-Security-Policy header to restrict script execution. Consequently, when an administrator views or opens one of these stored HTML or SVG files within the admin interface, the embedded malicious scripts execute directly in the context of that administrator's active session. This environment allows attackers to perform actions with the privileges of the viewing user, leading to potential account takeover and data exfiltration. In the 2.x implementation line, this capability is particularly dangerous because it enables privilege escalation through a secondary vulnerability within packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php. Although direct account creation by low-privileged users is blocked, the store method of this component checks access settings held by the viewing administrator but blindly trusts client-supplied role_id values. By leveraging the executed script to manipulate these parameters, an attacker can create a new administrative account with arbitrary permissions and passwords chosen by the adversary.
This newly created persistent admin account provides comprehensive control over the platform, including access to sensitive customer data, order histories, system settings, and user or role management interfaces. The persistence of this backdoor remains even after the initial uploaded malicious file is deleted from the media library, ensuring long-term unauthorized access. Additionally, the same mechanism can be utilized for direct exfiltration of existing data or further privilege escalation by granting additional permissions to the attacker's account. While the 3.x prerelease line has mitigated part of this risk by excluding SVG files, it still permits executable product files in certain configurations, indicating that the underlying architectural flaw regarding MIME validation and inline serving persists across versions until fully addressed. The issue is resolved in Shopper version 2.10.1 and version 3.0.0-beta.3 through stricter input validation, proper MIME type enforcement, and likely the implementation of appropriate security headers such as Content-Disposition set to attachment for uploaded media to prevent inline execution.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS), specifically stored XSS where malicious scripts are permanently stored on the target server. It also relates to CWE-434 Unrestricted Upload of File with Dangerous Type and CWE-285 Improper Authorization, given the privilege escalation aspect involving role manipulation. In terms of attack tactics, this scenario maps closely to ATT&CK technique T1059 Command and Scripting Interpreter for executing malicious code within the browser context, as well as T1078 Valid Accounts where attackers leverage stolen or created credentials to maintain persistence and access sensitive resources. Mitigation strategies should include enforcing strict allowlists for MIME types on both client and server sides, implementing Content Security Policy headers with nonces or hashes to prevent unauthorized script execution even if injection occurs, ensuring all uploaded files are served as attachments rather than inline content, and applying principle of least privilege by validating role assignments against authorized lists on the backend without trusting client-supplied identifiers.