CVE-2026-21449: Bagisto SSTI Vulnerability via User Input
Summary
CVE-2026-21449: Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users. Affects bagisto/bagisto versions < 2.3.10. Fixed in 2.3.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bagisto is an open-source eCommerce framework built on Laravel, designed to provide a robust platform for online stores. It offers features such as product management, order management, and customer management, making it a popular choice for developers. However, it is vulnerable to Server-Side Template Injection (SSTI) through user input, specifically in the first name and last name fields, which can be exploited by low-privilege users.
Vulnerability Detail
The vulnerability arises from the ability of non-admin users to inject template code into the first name and last name fields. By entering a template expression like {{7*7}}, the application evaluates this expression and displays the result (49) instead of treating it as plain text. This can lead to serious security risks, including Remote Code Execution (RCE) and command injection, as attackers can potentially execute arbitrary code on the server.
How To Fix
Minimum fixed version
2.3.10
This is the first release that contains the fix.
composer require bagisto/bagisto:2.3.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user input in the profile editing section to prevent template code from being executed. For example, you can strip out any template syntax from the input fields before saving them to the database.
Conclusion
In summary, the vulnerability identified as CVE-2026-21449 in the Bagisto package allows low-privilege users to exploit SSTI through user input. It is crucial to update to version 2.3.10 or later to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for bagisto/bagisto →
FAQ
Server-Side Template Injection (SSTI) is a type of vulnerability that allows an attacker to inject template code into a web application, which can then be executed on the server.
An attacker can exploit this vulnerability by entering crafted input into the first name or last name fields, which can lead to the execution of arbitrary code on the server.
The impacts can include unauthorized access to sensitive data, server compromise, and the ability to execute arbitrary commands on the server.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bagisto/bagisto.
