CVE-2026-21449: Bagisto has SSTI via first and last name from low-privilege user (not admin)
Summary SSTI is possible via first name and last name parameters provided by lowest-privileged users. Details 1. Go to http://127.0.0.1:8000/ and login or signup 2. Go to http://127.0.0.1:8000/customer/account/profile 3. Now edit the first name and last name to {{77}} 4. Notice it appears as 49
POC - Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912
Impact This can lead to RCE, command injection.
Other sources
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21449?
CVE-2026-21449 is considered a moderate severity vulnerability due to its potential impact on server-side template injection.
How do I fix CVE-2026-21449?
To fix CVE-2026-21449, upgrade Bagisto to version 2.3.10 or later.
Who is affected by CVE-2026-21449?
Users of Bagisto versions prior to 2.3.10 are affected by CVE-2026-21449.
What type of vulnerability is CVE-2026-21449?
CVE-2026-21449 is a server-side template injection vulnerability.
Can low-privilege users exploit CVE-2026-21449?
Yes, low-privilege users can exploit CVE-2026-21449 through the first name and last name input fields.