Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

NGHIÊM TRỌNG 9.8CVE-2026-21448 · GHSA-5j4h-4f72-qpm6 · Công bố 02/01/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-21448 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng bagisto/bagisto, bagisto (webkul).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.92%, cao hơn 60.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.3.10 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
bagisto/bagisto Packagist	`< 2.3.10`	`2.3.10`
bagisto webkul	`< 2.3.10`	`2.3.10`

Mô tả

Summary

SSTI when normal customer orders any product in add address step can inject value run in admin view.

Details

As normal user

Go to http://127.0.0.1:8000/
Add order to cart and continue to checkout
In step of add address inject this value {{7*7}} in any input

As admin

Go to http://127.0.0.1:8000/admin/sales/orders
And notice the vlaue appear in admin view 49

As normal user 3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{7*7}} on it and will notice it appear 49 <img width="1868" height="868" alt="image" src="https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25" />

PoC

Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d

Impact

Can lead to RCE

Mô tả của NVD

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.