Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62990— Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

Quick assessment

Affected
shopperlabs shopper
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Shopper 是一个无头（Headless）电子商务后台管理面板。在 2.0.0 至 2.10.1 之前的版本，以及 3.0.0 的预发布版本 beta.1 和 beta.2 中，拥有内容上传权限的已认证后台工作人员，可以将可执行媒体文件存储到管理员自身的源站（origin）上。 在 2.x 版本的实现中，相关的上传权限包括 或 。配置文件 在所有媒体集合（包括那些原本仅接受 类型但同时也接受 SVG 的图像字段）中均允许 类型。此外，产品文件集合（位于 ）未设置 MIME 类型限制，因此也接受 类型。 这些媒体

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62990

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
Source: CVE Program / CVE List V5
Vulnerability Description
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant upload permissions include `edit_products` or `add_brands`, and `packages/admin/config/media.php` allows `image/svg+xml` in every media collection, including image fields whose image/* validation also accepts SVG. The product files collection in `packages/admin/src/Livewire/Components/Products/Form/Files.php` has no MIME restriction and accepts `text/html` as well. Media is served inline from the `public` disk under `/storage/` with its own content type, without `Content-Disposition: attachment` or a `Content-Security-Policy`. When an administrator opens an uploaded HTML or SVG file, stored script executes in that administrator's session. In 2.x, the script can invoke `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, whose `store()` checks `access_setting` held by the viewing administrator but trusts client-supplied `role_id`, to create a new attacker-controlled administrator with a chosen password. This account persists after the uploaded file is deleted and gives access to customer data, orders, settings, and user/role management; the same script can exfiltrate data or grant permissions to the attacker's account. Direct account creation by the low-privileged uploader is blocked, so exploitation requires the administrator to open the file. The 3.x prerelease line already excludes SVG but still allows executable product files. This issue is fixed in versions 2.10.1 and 3.0.0-beta.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
shopperlabs shopper >= 2.0.0, < 2.10.1 -

II. Public POCs for CVE-2026-62990

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62990

请登录查看更多情报信息。

Other References for CVE-2026-62990 (8)

Same Patch Batch · shopperlabs · 2026-10-30 · 3 CVEs total

CVE-2026-62989 8.1 HIGH Shopper: missing variant-delete authorization permits destructive single and bulk actions
CVE-2026-62991 6.5 MEDIUM Shopper: customer detail IDOR exposes administrator and staff records

IV. Related Vulnerabilities

Same product: shopper
Same vendor: shopperlabs
Same weakness: CWE-79