CVE Catalog
CVE-2026-21450
CriticalSummary
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.
Risk Assessment
An attacker can execute arbitrary code on the server, potentially leading to full compromise of the application and data.
Recommendation
It is recommended to update to version 2.3.10 or later.
Original NVD description (English source)
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.