CVE-2026-21448: Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
Summary SSTI when normal customer orders any product in add address step can inject value run in admin view. Details As normal user 1. Go to http://127.0.0.1:8000/ 2. Add order to cart and continue to checkout 3. In step of add address inject this value {{77}} in any input
As admin 1. Go to http://127.0.0.1:8000/admin/sales/orders 2. And notice the vlaue appear in admin view 49
As normal user 3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{77}} on it and will notice it appear 49 <img width="1868" height="868" alt="image" src="https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25" />
PoC - Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d
Impact - Can lead to RCE
Other sources
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the add address step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21448?
CVE-2026-21448 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-21448?
To fix CVE-2026-21448, update Bagisto to version 2.3.10 or later.
What causes CVE-2026-21448?
CVE-2026-21448 is caused by a server-side template injection vulnerability in versions prior to 2.3.10.
Who is affected by CVE-2026-21448?
Any user of Bagisto versions prior to 2.3.10 is affected by CVE-2026-21448.
What are the potential impacts of CVE-2026-21448?
The potential impacts of CVE-2026-21448 include unauthorized execution of code and possible takeover of the web application.