Sign in
Deutsch English Español Polski
High

Bagisto is vulnerable to XSS through Admin Panel's product creation path

  • Disclosed: 10.10.2025
  • Updated: 11.10.2026 10:22

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package bagisto/bagisto >= 2.3.6, < 2.3.7 2.3.7

References

CVSS score 8.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H
Weakness (CWE)
CWE-79
Platform
Composer
Package
bagisto/bagisto
Disclosed
10.10.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-29mf-w486-v3vc - CC BY 4.0

Vulnerability history: bagisto/bagisto

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (20) in the archive
Total entries
20
First → latest
11.2019 04.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 8
  • Medium 9
  • Low 2

Disclosures per year

Severity:
  1. Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
    High · 8.8 CVE-2026-21449 < 2.3.10 2.3.10
  2. Bagisto has IDOR in Customer Order Reorder Functionality
    High · 7.1 CVE-2026-21447 < 2.3.10 2.3.10
  3. Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
    High · 9.8 CVE-2026-21448 < 2.3.10 2.3.10
  4. Bagisto SSTI vulnerability in type parameter can lead to RCE
    High CVE-2026-21450 < 2.3.10 2.3.10
  5. Bagisto Missing Authentication on Installer API Endpoints
    High · 9.8 CVE-2026-21446 >= 2.3.0, < 2.3.10 2.3.10
  6. bagisto has CSV Formula Injection in Create New Product
    Critical · 9.0 CVE-2025-62417 < 2.3.8 2.3.8
  7. Bagisto is vulnerable to XSS through Admin Panel's product creation path this entry
    High · 8.3 CVE-2025-60880 >= 2.3.6, < 2.3.7 2.3.7
  8. Bagisto Cross-Site Request Forgery vulnerability
    High · 8.8 CVE-2023-36237 < 1.3.2 1.3.2
  9. Bagisto CSRF Vulnerability
    High · 8.8 CVE-2019-14933 < 0.1.5 0.1.5

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.