What is the CVSS score of CVE-2026-21449?

CVE-2026-21449 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Laravel are affected by CVE-2026-21449?

Organizations using Bagisto face significant risk from CVE-2026-21449 rated CVSS 8.8.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21449?

Yes, a public proof-of-concept exploit is available for CVE-2026-21449. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-21449?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Laravel CVE-2026-21449

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-01-02 security-advisories@github.com

GHSA-mqhg-v22x-pqj8

Laravel Bagisto

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 08, 2026 - 21:21 vuln.today

Public exploit code

CVE Published

Jan 02, 2026 - 21:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.

AnalysisAI

Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.

Technical ContextAI

Affects Bagisto. Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Laravel

View all

CVE-2017-16894 HIGH Act Now POC

7.5 Nov 20

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo

CVE-2025-54068 CRITICAL Act Now POC

9.8 Jul 17

Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th

CVE-2025-53833 CRITICAL Act Now POC

10.0 Jul 14

LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C

CVE-2026-28289 CRITICAL Act Now POC

10.0 Mar 03

File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.

CVE-2026-27636 HIGH Act Now POC

8.8 Feb 25

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that

CVE-2018-15133 HIGH Act Now POC

8.1 Aug 09

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

CVE-2025-70841 CRITICAL Act Now POC

10.0 Feb 03

Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai

CVE-2026-27637 CRITICAL Act Now POC

9.8 Feb 25

Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers

CVE-2026-21448 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address

CVE-2026-21446 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth

CVE-2022-2870 CRITICAL Act Now POC

9.8 Aug 17

A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera

CVE-2022-2886 HIGH This Week POC

8.8 Aug 19

A vulnerability, which was classified as critical, was found in Laravel 5.1. Rated high severity (CVSS 8.8), this vulner

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all

CVE-2025-47916 CRITICAL POC

10.0

CVE-2025-49619 HIGH POC

8.5

CVE-2024-6386 CRITICAL POC

9.9

CVE-2025-69516 HIGH POC

8.8

CVE-2025-49136 CRITICAL POC

9.0

CVE-2025-53833 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2025-23211 CRITICAL POC

9.9

CVE-2026-21449 vulnerability details – vuln.today

Back

Laravel CVE-2026-21449

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Laravel

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

Share

External POC / Exploit Code