CVE-2026-21448
Critical · 9.8Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
CVSS
9.8
EPSS
0.9%
Published
Jan 2, 2026
CISA due date
—
The record
SSTI when normal customer orders any product in add address step can inject value run in admin view.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | bagisto/bagisto | 0 | 2.3.10 |
Related vulnerabilities
- GHSA-5j4h-4f72-qpm6 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product Same vulnerability
- GHSA-mqhg-v22x-pqj8 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- GHSA-x5rw-qvvp-5cgm Bagisto has IDOR in Customer Order Reorder Functionality Also affects bagisto/bagisto
- GHSA-9hvg-qw5q-wqwp Bagisto SSTI vulnerability in type parameter can lead to RCE Also affects bagisto/bagisto
- GHSA-2mwc-h2mg-v6p8 Bagisto has HTML Filter Bypass that Enables Stored XSS Also affects bagisto/bagisto
- GHSA-6h7w-v2xr-mqvw Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto
- CVE-2026-21449 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- CVE-2026-21446 Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto