CVE-2026-21449
High · 8.8Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
CVSS
8.8
EPSS
0.5%
Published
Jan 2, 2026
CISA due date
—
The record
SSTI is possible via first name and last name parameters provided by lowest-privileged users.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | bagisto/bagisto | 0 | 2.3.10 |
Related vulnerabilities
- GHSA-mqhg-v22x-pqj8 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Same vulnerability
- GHSA-x5rw-qvvp-5cgm Bagisto has IDOR in Customer Order Reorder Functionality Also affects bagisto/bagisto
- GHSA-5j4h-4f72-qpm6 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product Also affects bagisto/bagisto
- GHSA-9hvg-qw5q-wqwp Bagisto SSTI vulnerability in type parameter can lead to RCE Also affects bagisto/bagisto
- GHSA-2mwc-h2mg-v6p8 Bagisto has HTML Filter Bypass that Enables Stored XSS Also affects bagisto/bagisto
- GHSA-6h7w-v2xr-mqvw Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto
- CVE-2026-21446 Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto
- CVE-2026-21448 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product Also affects bagisto/bagisto