critical9.8
CVE-2026-21450
Bagisto SSTI vulnerability in type parameter can lead to RCE
Impact
### Summary SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations. ### Details 1. Go to `http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}` <img width="1251" height="282" alt="image" src="https://github.com/user-attachments/assets/652e96f4-631e-4322-8561-63f4d897a480" /> ### Impact Can lead to RCE, command injection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | bagisto/bagisto | < 2.3.10 | 2.3.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webkul | Bagisto | before 2.3.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/bagisto/bagisto/security/advisories/GHSA-9hvg-qw5q-wqwp
- https://github.com/advisories/GHSA-9hvg-qw5q-wqwp
- https://nvd.nist.gov/vuln/detail/CVE-2026-21450
- https://github.com/bagisto/bagisto/commit/3f294b4837595929107d9c1bbd6d5b1222ef9fea
- https://github.com/bagisto/bagisto/releases/tag/v2.3.10