Server-Side Template Injection Vulnerability in Bagisto eCommerce Platform
CVE-2026-21449

7.4HIGH

Key Information:

Vendor

Bagisto

Status
Bagisto
Vendor
CVE Published:
2 January 2026

What is CVE-2026-21449?

Bagisto, an open source Laravel eCommerce platform, is susceptible to a server-side template injection vulnerability. This issue is found in versions before 2.3.10, allowing low-privilege users to exploit the platform through crafted inputs in first name and last name fields. The vulnerability could lead to unauthorized access and manipulation of template rendering, potentially compromising the integrity and security of user data. The issue is addressed in version 2.3.10, which is recommended for all users to ensure optimal protection against this threat.

Affected Version(s)

bagisto < 2.3.10

References

https://github.com/bagisto/bagisto/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.