CVE-2025-56426 — Command Injection in Bagisto

CWE-77 — Command Injection3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 63.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Webkul Bagisto
Timeline
PublishedOct 9

Description

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages1 packages

▶NVDwebkul/bagisto2.3.6

🔴Vulnerability Details

2
CVEList
CVE-2025-56426: An issue WebKul Bagisto v↗2025-10-09
▶
GHSA
GHSA-826h-vw99-v546: An issue WebKul Bagisto v↗2025-10-09
▶
CVE-2025-56426 — Command Injection in Webkul Bagisto | cvebase