In breve
- CVE-2026-21450 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda bagisto/bagisto, bagisto (webkul).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.4%, superiore al 71.8% delle vulnerabilità.
- Correzione: aggiornare a 2.3.10 o successiva.
Description
Summary
SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.
Details
- Go to
http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}
<img width="1251" height="282" alt="image" src="https://github.com/user-attachments/assets/652e96f4-631e-4322-8561-63f4d897a480" />
Impact
Can lead to RCE, command injection.
NVD description
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free