CVE-2026-21449: Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
Summary SSTI is possible via first name and last name parameters provided by lowest-privileged users. Details 1. Go to http://127.0.0.1:8000/ and login or signup 2. Go to http://127.0.0.1:8000/customer/account/profile 3. Now edit the first name and last name to {{77}} 4. Notice it appears as 49
POC - Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912
Impact This can lead to RCE, command injection.
Other sources
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.
— MITRE
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/bagisto/bagistoto a version that resolves this vulnerability.Fixed in 2.3.10 - Upgrade
Upgrade
Bagistoto a version that resolves this vulnerability.Fixed in 2.3.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21449?
CVE-2026-21449 is considered a moderate severity vulnerability due to its potential impact on server-side template injection.
How do I fix CVE-2026-21449?
To fix CVE-2026-21449, upgrade Bagisto to version 2.3.10 or later.
Who is affected by CVE-2026-21449?
Users of Bagisto versions prior to 2.3.10 are affected by CVE-2026-21449.
What type of vulnerability is CVE-2026-21449?
CVE-2026-21449 is a server-side template injection vulnerability.
Can low-privilege users exploit CVE-2026-21449?
Yes, low-privilege users can exploit CVE-2026-21449 through the first name and last name input fields.