CVE-2026-21450

CVSS Score & Metrics

Base Score

9.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

Vulnerability Details

Published Date

January 02, 2026

Last Modified

January 08, 2026

CWE ID

CWE-1336

Source

NVD

Vendor

webkul

Product

bagisto

External References

https://github.com/bagisto/bagisto/security/advisories/GHSA-9hvg-qw5q-wqwp

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment