CVE-2026-21448

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/bagisto/bagisto/security/advisories/GHSA-5j4h-4f72-qpm6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:18

Type	Values Removed	Values Added
Summary		(es) Bagisto es una plataforma de comercio electrónico laravel de código abierto. Las versiones anteriores a la 2.3.10 son vulnerables a la inyección de plantillas del lado del servidor. Cuando un cliente normal pide cualquier producto, en el paso 'añadir dirección' pueden inyectar un valor para ejecutar en la vista de administrador. El problema puede llevar a la ejecución remota de código. La versión 2.3.10 contiene un parche.

08 Jan 2026, 21:22

Type	Values Removed	Values Added
CPE		cpe:2.3:a:webkul:bagisto::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Webkul bagisto Webkul
References	~~() https://github.com/bagisto/bagisto/security/advisories/GHSA-5j4h-4f72-qpm6 -~~	() https://github.com/bagisto/bagisto/security/advisories/GHSA-5j4h-4f72-qpm6 - Exploit, Vendor Advisory

02 Jan 2026, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-02 21:15

Updated : 2026-06-17 10:18

NVD link : CVE-2026-21448

Mitre link : CVE-2026-21448

CVE.ORG link : CVE-2026-21448

JSON object : View

Products Affected

webkul

bagisto

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-21448", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21448", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-02T21:29:24.779685Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"status": "affected", "version": "< 2.3.10"}]}]}], "published": "2026-01-02T21:15:59.053", "references": [{"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-5j4h-4f72-qpm6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch."}, {"lang": "es", "value": "Bagisto es una plataforma de comercio electr\u00f3nico laravel de c\u00f3digo abierto. Las versiones anteriores a la 2.3.10 son vulnerables a la inyecci\u00f3n de plantillas del lado del servidor. Cuando un cliente normal pide cualquier producto, en el paso 'a\u00f1adir direcci\u00f3n' pueden inyectar un valor para ejecutar en la vista de administrador. El problema puede llevar a la ejecuci\u00f3n remota de c\u00f3digo. La versi\u00f3n 2.3.10 contiene un parche."}], "lastModified": "2026-06-17T10:18:41.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9A19FD0-5100-48D6-BBB3-5A4CA1D90593", "versionEndExcluding": "2.3.10"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}