CVE-2026-49849 is a critical unrestricted file upload vulnerability in xShop, an open-source, self-hosted e-commerce platform built on Laravel. The flaw lies in the admin panel's file attachment module, which fails to properly restrict the type of file an authenticated administrator can upload, allowing a PHP script to be uploaded and stored in a location the web server will execute.

Exploitation requires an attacker to already hold administrator-level access to the xShop admin panel. Once a malicious script is uploaded, the attacker gains remote code execution on the underlying server, turning an admin-panel compromise into complete server compromise.

The following software and version(s) are affected:

xShop (self-hosted, open-source Laravel e-commerce platform), version 3.0.3 – (Affected)
xShop version 3.0.4 and later – (Not affected, patched)

There is no evidence of active exploitation at the time of this advisory. The vendor (4xmen) has already published a fixed release, v3.0.4, on GitHub.

Typical attack flow:

1. Attacker obtains administrator-level access — The attacker gains admin-panel access through means such as stolen or phished credentials, a rogue insider, or by chaining this flaw with a separate credential-theft vulnerability. This CVE does not itself grant that initial access.
2. Attacker uploads a malicious script via the file attachment module — The attacker uploads a file with a dangerous extension, such as a PHP script, which the file attachment module does not properly restrict or validate.

Attack vectors:

• A malicious or compromised administrator account
• An attacker who has phished or otherwise obtained valid admin credentials

Successful exploitation allows attackers to:

• Execute arbitrary code on the underlying server with the privileges of the web server process
• Achieve complete system compromise — reading or modifying the database, stealing customer and payment data, and using the server as a foothold for further attacks

CERTVU recommends the following:

1. Upgrade to xShop v3.0.4 Immediately

   The vendor (4xmen) has released a fixed version, v3.0.4, on GitHub, which corrects the file attachment module's upload validation. Treat this as an emergency change given the CVSS 9.1 rating and the potential for complete server compromise.

2. Restrict Admin Panel Access

   Use IP allowlisting or a VPN, and enforce multi-factor authentication for all administrator accounts, since exploitation depends on an attacker first obtaining admin-level access.

Other mitigating options include;

• Audit for Signs of Compromise
• Harden Upload Directories
• Rotate administrator credentials as a precaution if compromise cannot be ruled out

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.