Bagist Cross-site Scripting vulnerability

MEDIUM 6.5CVE-2024-27499 · GHSA-w5mx-334j-6fwv · Published 01/03/2024 · updated 17/06/2026

In short

CVE-2024-27499 is a MEDIUM (CVSS 6.5) vulnerability affecting bagisto/bagisto, bagisto (webkul).
Chance of exploitation in the next 30 days (EPSS): 0.52%, higher than 44.3% of all vulnerabilities.
Fix: update to 2.1.0 or later.

Package	Affected versions	Patched versions
bagisto/bagisto Packagist	`< 2.1.0`	`2.1.0`
bagisto webkul	`= 1.5.1`	No fix yet

Bagisto is vulnerable to cross-site scripting (XSS) via png file upload vulnerability in product review option.

NVD description

Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

< 2.1.0

2.1.0

= 1.5.1

No fix yet

More vulnerabilities in bagisto/bagisto

See all →