Bagisto SSTI vulnerability in type parameter can lead to RCE

CRITICAL 9.8CVE-2026-21450 · GHSA-9hvg-qw5q-wqwp · Published 02/01/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
bagisto/bagisto Packagist	`< 2.3.10`	`2.3.10`
bagisto webkul	`< 2.3.10`	`2.3.10`

Description

Summary

SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.

Details

Go to http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}

Impact

Can lead to RCE, command injection.

NVD description

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

References

bagisto/bagisto security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-21450 · ADVISORY
bagisto/bagisto commit 3f294b4 · WEB
bagisto/bagisto · PACKAGE
bagisto/bagisto release v2.3.10 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free