Server-Side Template Injection in Bagisto eCommerce Platform
CVE-2026-21448

8.9HIGH

Key Information:

Vendor

Bagisto

Status
Bagisto
Vendor
CVE Published:
2 January 2026

What is CVE-2026-21448?

Bagisto, an open-source eCommerce platform built on Laravel, is susceptible to a server-side template injection vulnerability that affects versions prior to 2.3.10. This security flaw allows an uncontrolled input during the 'add address' step of the customer ordering process, where a malicious user could inject code that runs in the admin view. This vulnerability potentially allows for remote code execution, posing significant security risks. Users are encouraged to upgrade to version 2.3.10 or later to secure their installations. For additional details, refer to the official security advisory.

Affected Version(s)

bagisto < 2.3.10

References

https://github.com/bagisto/bagisto/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.