Bagisto CVE-2025-62415

Exploitation requires an authenticated account with upload/content privileges in the Bagisto admin panel (PR:H) - specifically access to the TinyMCE image-upload feature used for rich content. The core technical condition is the backend's content-sniffing behavior: a file uploaded with a .png extension whose contents are detected as HTML/JavaScript is automatically re-saved with a .html extension, defeating the HTML-upload block. Realistic exploitation is further limited by the need for a second user (another admin or editor) to actively open/view the stored file (UI:R) for the payload to fire; it does not execute automatically. There is no unauthenticated or default-configuration path, which is the primary factor reducing real-world risk.

This is a stored/HTML-injection XSS (CWE-80) in Bagisto 2.3.7's TinyMCE image-upload feature, and the aggregate signals point to a genuine but low-to-moderate priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base 4.8 Medium) shows the defining constraint: PR:H means the attacker must already hold a high-privilege (admin/editor) account to upload the file, and UI:R means a victim must actively view the malicious content, so this is not a drive-by remote compromise. The scope change (S:C) and the GHSA impact note (targeting other admins/editors for session hijacking, unauthorized actions, or privilege escalation) are what give it real teeth: a lower-trust content editor could escalate against a higher-trust admin. Exploitation maturity is mixed - a working POC is publicly available (publicly available exploit code exists), which raises the practical likelihood of use, but the EPSS score is low at 0.28% (19th percentile) and the CVE is NOT in CISA KEV (no public exploit identified as actively exploited). The low EPSS is consistent with the high privilege prerequisite: this requires insider/compromised-account access, so widespread automated exploitation is unlikely. No signals conflict materially; the authenticated, user-interaction-gated nature is corroborated across the CVSS vector and the vendor advisory text.

An attacker who controls a Bagisto admin or content-editor account (e.g., a lower-privileged editor or a compromised account) creates an HTML file containing embedded JavaScript, renames it with a .png extension, and uploads it through TinyMCE; the backend detects the HTML/JS content and converts the file back to .html. When another admin or editor later opens that file in their browser, the script executes in their authenticated session, enabling session hijacking or actions on their behalf. A public POC demonstrating the .png-to-.html conversion bypass exists.