CVE-2026-21448
CriticalSummary
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.
Risk Assessment
An attacker can execute code in the admin context, potentially leading to takeover of the admin panel and data.
Recommendation
It is recommended to update to version 2.3.10 or later.
Original NVD description (English source)
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.