Bagisto CVE-2025-62418

Requires an authenticated back-office account with access to the TinyMCE image-upload / media-manager feature (the advisory cites admin or sufficiently privileged users), so this is gated by PR:H - not remote-unauthenticated. The specific prerequisite is that Bagisto 2.3.7 accepts SVG uploads without sanitizing or stripping embedded script, event handlers (onload/onclick), <script>, foreignObject or xlink:href injection, and later renders the SVG inline/embedded. Exploitation is further limited by the need for a second user (admin/editor) to actually view the stored content (UI:R), so it is a stored/second-order XSS rather than a one-click external attack. Environments on 2.3.8 or later are not affected.

This is a genuine but modest-severity issue, and the signals are largely consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base 4.8 Medium) describes a stored XSS that requires an attacker to already hold high privileges (PR:H - e.g. an admin or editor with media-upload rights) and requires a victim to subsequently view the content (UI:R). The scope change (S:C) reflects that injected SVG script executes in a different security context - the victim's authenticated browser session. EPSS is low (0.28%, 19th percentile), which aligns with a non-KEV vulnerability requiring privileged access and user interaction rather than mass-exploitable remote code execution. A public PoC exists (demonstrating that a crafted SVG triggers JavaScript in the editor), confirming the technique is real, but PoC availability is NOT the same as active exploitation - there is no CISA KEV listing and no evidence of in-the-wild use. The main caveat is that PR:H meaningfully limits the real-world threat: the attacker is already a trusted back-office user, so the practical value is privilege escalation/lateral movement between admin/editor accounts (session hijacking, actions as a higher-privileged admin) rather than external compromise. Net: a legitimate finding worth patching, but not an emergency - it is a high-CVSS-but-privilege-gated issue, not a wormable remote flaw.

A low-trust back-office user (editor or sub-admin) with media/TinyMCE upload rights uploads a crafted SVG containing embedded JavaScript via the image-upload/media-manager feature. When a higher-privileged administrator or another editor later opens the page or content that renders the SVG inline, the embedded script executes in that victim's authenticated session, enabling session/cookie theft and actions performed as the victim. A public proof-of-concept exists demonstrating that the SVG's JavaScript fires when the content is viewed.