CVE-2026-121733: Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated customer who can use the RMA send-message endpoint can upload a malicious HTML attachment. Exploitation requires an administrator to open the uploaded attachment.
Which deployments are affected?
Bagisto versions before 2.4.5 are affected. The vulnerable behavior is the acceptance of HTML attachments without type or extension validation through RMA conversation messages.
What is the practical impact of a successful attack?
JavaScript embedded in the uploaded HTML file runs in the shop's origin when an administrator opens the attachment. This can expose information available to that administrator and allow actions in the administrator's browser context.
What can be done if updating is not immediately possible?
Restrict or disable customer attachment uploads through the RMA send-message functionality, or prevent HTML files from being accepted and served from the RMA conversation storage path. Administrators should avoid opening untrusted RMA attachments.