En resumen
- CVE-2026-21450 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a bagisto/bagisto, bagisto (webkul).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 71.8% de las vulnerabilidades.
- Solución: actualizar a 2.3.10 o posterior.
Description
Summary
SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.
Details
- Go to
http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}
<img width="1251" height="282" alt="image" src="https://github.com/user-attachments/assets/652e96f4-631e-4322-8561-63f4d897a480" />
Impact
Can lead to RCE, command injection.
NVD description
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free