CVE-2026-21448
published 2026-01-02CVE-2026-21448: Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.83%
53.1th percentile
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bagisto | bagisto | < 2.3.10 | 2.3.10 |
| bagisto | bagisto | >= 0 < 2.3.10 | 2.3.10 |
| webkul | bagisto | < 2.3.10 | 2.3.10 |
Detection & IOCsextracted from sources · hover to see the quote
- →SSTI injection point is the 'add address' step during customer order flow in Bagisto; malicious template expressions entered in address fields will be evaluated in the admin view, potentially leading to RCE ↗
- →Affected platform is Bagisto (bagisto/bagisto) versions prior to 2.3.10; monitor for suspicious template syntax (e.g., Blade/Twig expressions) in address form fields submitted by customers ↗
- →A public exploit exists for this CVE; prioritize detection and patching accordingly ↗
- ·The vulnerability is fixed in Bagisto version 2.3.10; only instances running versions prior to 2.3.10 are affected ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
osv·2026-01-02
CVE-2026-21448 [HIGH] Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
### Summary
SSTI when normal customer orders any product in add address step can inject value run in admin view.
### Details
`As normal user`
1. Go to `http://127.0.0.1:8000/`
2. Add order to cart and continue to checkout
3. In step of add address inject this value {{7*7}} in any input
`As admin`
1. Go to `http://127.0.0.1:8000/admin/sales/orders`
2. And notice the vlaue appear in admin view 49
`As normal user`
3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49
### PoC
- Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d
### Impact
- Can lead to RCE
GHSA
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
ghsa·2026-01-02
CVE-2026-21448 [HIGH] CWE-1336 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
### Summary
SSTI when normal customer orders any product in add address step can inject value run in admin view.
### Details
`As normal user`
1. Go to `http://127.0.0.1:8000/`
2. Add order to cart and continue to checkout
3. In step of add address inject this value {{7*7}} in any input
`As admin`
1. Go to `http://127.0.0.1:8000/admin/sales/orders`
2. And notice the vlaue appear in admin view 49
`As normal user`
3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49
### PoC
- Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d
### Impact
- Can lead to RCE
No detection rules found.
No public exploits indexed.
2026-01-02
Published