GHSA-9hvg-qw5q-wqwpHigh

Bagisto SSTI vulnerability in type parameter can lead to RCE

Published
January 2, 2026
Last Modified
January 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-21450 →

📋 Description

Summary

SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.

Details

  1. Go to http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}

Impact

Can lead to RCE, command injection.

🎯 Affected products1

  • composer/bagisto/bagisto:< 2.3.10

🔗 References (5)