CVE-2026-49849
CriticalCVSS 9.1Summary
xShop is an open-source shop developed in Laravel. Version 3.0.3 has an Unrestricted File Upload vulnerability that allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted PHP file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
Risk Assessment
The risk to the organization includes full server compromise by an attacker, potentially leading to data theft, system integrity violation, and service disruption.
Recommendation
It is recommended to immediately upgrade xShop to version 3.0.4 or later to eliminate the unrestricted file upload vulnerability.
Original NVD description (English source)
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.