CVE-2026-21450
High · 7.2Bagisto SSTI vulnerability in type parameter can lead to RCE
CVSS
7.2
EPSS
1.4%
Published
Jan 2, 2026
CISA due date
—
The record
SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | bagisto/bagisto | 0 | 2.3.10 |
Related vulnerabilities
- GHSA-9hvg-qw5q-wqwp Bagisto SSTI vulnerability in type parameter can lead to RCE Same vulnerability
- GHSA-mqhg-v22x-pqj8 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- GHSA-x5rw-qvvp-5cgm Bagisto has IDOR in Customer Order Reorder Functionality Also affects bagisto/bagisto
- GHSA-5j4h-4f72-qpm6 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product Also affects bagisto/bagisto
- GHSA-2mwc-h2mg-v6p8 Bagisto has HTML Filter Bypass that Enables Stored XSS Also affects bagisto/bagisto
- GHSA-6h7w-v2xr-mqvw Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto
- CVE-2026-21449 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- CVE-2026-21446 Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto