Script Injection Vulnerability in Bagisto eCommerce Platform
CVE-2025-62418

6.9MEDIUM

Key Information:

Vendor

Bagisto

Status
Bagisto
Vendor
CVE Published:
16 October 2025

What is CVE-2025-62418?

An exploit in Bagisto version 2.3.7 allows an authenticated user with admin privileges to upload malicious SVG files containing JavaScript. When these files are viewed, the embedded scripts execute in the browser context of the user, posing a significant security risk. This issue has been addressed in version 2.3.8.

Affected Version(s)

bagisto < 2.3.8

References

https://github.com/bagisto/bagisto/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-62418 : Script Injection Vulnerability in Bagisto eCommerce Platform