Bagisto CVE-2026-121733

The attacker must hold an authenticated Bagisto customer account (PR:L) and the store's RMA (Return Merchandise Authorization) return-request feature must be in use, since exploitation goes through the RMA send-message/conversation endpoint; pre-2.4.5 that endpoint accepts attachments without enforcing file type or extension (the allowed_file_extension configuration was not validated server-side), so a .html file carrying JavaScript is stored and later served from /storage/rma-conversation/ under the shop's origin. The decisive limiting factor is victim interaction: the payload only fires when a store administrator opens the uploaded attachment in their browser (UI:P) - it does not execute automatically. Combined limits are therefore valid customer authentication, an active RMA workflow, and an administrator choosing to open the attachment, which together confine impact to the administrator's browser session rather than the server.

This is a genuinely low-priority issue, consistent across every available signal rather than a high-CVSS/low-real-risk mismatch. The supplied CVSS 4.0 base score is 2.1 (Low), and the vuln.today Decision label is 'monitor'. Exploitation status is no public exploit identified at time of analysis - there is no CISA KEV listing and no POC/exploit code in the input; the VulnCheck entry is an advisory, not working exploit code. No EPSS score is provided, so probabilistic exploitation likelihood cannot be quantified from this data. The CVSS 4.0 vector itself tempers urgency: it requires authenticated access (PR:L - an attacker needs a valid shop customer account), an attack requirement (AT:P) and victim interaction (UI:P), and it models no impact on the vulnerable system (VC:N/VI:N/VA:N) with only low subsequent-system confidentiality and integrity impact (SC:L/SI:L) reflecting script execution in an administrator's browser. The chief caveat is that CVSS 4.0's VC:N/VI:N/VA:N understates how stored XSS feels operationally - if an admin session is hijacked, real administrative actions become possible - but the scoring treats that as subsequent-system impact, keeping the base score low. Net: low real-world priority, bounded by both the authentication requirement and the need for an administrator to open the malicious attachment.

A malicious party who holds (or registers) an authenticated shop customer account opens a Return Merchandise Authorization (RMA) conversation and, via the send-message endpoint, uploads a .html attachment containing JavaScript, which Bagisto before 2.4.5 stores under /storage/rma-conversation/ without validating file type or extension. When a store administrator later opens that attachment, the script executes in the shop's own origin in the admin's browser, enabling actions such as session/cookie theft or requests made as the administrator. No public exploit code is identified; exploitation also depends on an administrator actually opening the file.