GHSA-mqhg-v22x-pqj8HighCVSS 8.8

Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users

Published
January 2, 2026
Last Modified
January 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-21449 →

📋 Description

Summary

SSTI is possible via first name and last name parameters provided by lowest-privileged users.

Details

  1. Go to http://127.0.0.1:8000/ and login or signup
  2. Go to http://127.0.0.1:8000/customer/account/profile
  3. Now edit the first name and last name to {{7*7}}
  4. Notice it appears as 49

POC

  • Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912

Impact

This can lead to RCE, command injection.

🎯 Affected products1

  • composer/bagisto/bagisto:< 2.3.10

🔗 References (5)