In short
- CVE-2026-6744 is a MEDIUM (CVSS 6.3) vulnerability affecting bagisto/bagisto.
- Chance of exploitation in the next 30 days (EPSS): 0.20%, higher than 10.1% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| bagisto/bagisto Packagist | ≤ 2.3.15
| No fix yet |
Description
A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and explained: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
NVD description
A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
More vulnerabilities in bagisto/bagisto
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free