Headless E-commerce Admin Panel Vulnerability in Shopper
CVE-2026-62990
8.7HIGH
What is CVE-2026-62990?
The Shopper admin panel, in certain versions, allows authenticated staff to upload executable media files without sufficient MIME type restrictions. Specifically, SVG and HTML files can be uploaded via the media management system, enabling the execution of potentially malicious scripts within an administrator's session. This flaw can be exploited to create unauthorized administrator accounts and compromise sensitive customer data, orders, and configuration settings. Versions 2.10.1 and 3.0.0-beta.3 address this security issue by enhancing file upload restrictions.
Affected Version(s)
shopper >= 2.0.0, < 2.10.1 < 2.0.0, 2.10.1
shopper >= 3.0.0-beta.1, < 3.0.0-beta.3 < 3.0.0-beta.1, 3.0.0-beta.3