Stored XSS Vulnerability in Shopware 6 Installation Interface by Shopware

CVE-2025-51541

What is CVE-2025-51541?

A stored cross-site scripting (XSS) vulnerability in the installation interface of Shopware 6 allows attackers to execute malicious JavaScript code persistently. The vulnerability stems from the failure to sanitize user inputs in the c_database_schema field on the /recovery/install/database-configuration/ page. Moreover, the lack of cross-site request forgery (CSRF) protections in the associated POST request can be leveraged by an unauthenticated remote attacker to inject harmful scripts. When a victim visits an affected installation page, the stored payload executes, leading to potential unauthorized access and manipulation of user sessions.

References