Shopware 6.7 has a stored cross-site scripting (XSS) vulnerability in its media upload feature. This flaw allows attackers to compromise administrator credentials and achieve remote code execution. The vulnerability stems from the media upload API accepting HTML files which are then served as text/html without proper security headers. An attacker with media upload privileges can upload a malicious HTML file containing JavaScript. If an administrator accesses the media file, their authentication token can be stolen. This stolen token allows the attacker unauthorized access to the Shopware Administration API. If the compromised administrator has extension management rights, the attacker can install malicious plugins. This can lead to arbitrary PHP code execution on the server. No patch is currently available from Shopware. Users can mitigate the risk by restricting media upload access or disabling HTML file uploads.