Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-21450

Bagisto has SSTI in parameter that can lead to RCE

Description

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bagisto bagisto

  • < 2.3.10affected

References