EUVD-2026-24241Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
AnalysisAI
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Technical ContextAI
The vulnerability exists in Bagisto's Downloadable Link Handler component, specifically the copy function, which processes user-supplied input to retrieve or manipulate downloadable resources. The SSRF flaw (CWE-918) occurs when the application fails to properly validate or sanitize URL inputs before making backend HTTP requests, allowing an attacker to specify arbitrary target URLs. This is a classic SSRF pattern where user-controlled data is passed to a URL-making function without validation, enabling the attacker to probe internal networks, access cloud metadata endpoints (such as AWS IMDSv1), or retrieve sensitive files from internal systems. The vulnerability requires authenticated access (CVSS PR:L), limiting attack surface to users with valid Bagisto accounts.
RemediationAI
Primary remediation is to upgrade Bagisto to the next patched release after version 2.3.15 once available from the vendor; monitor the official Bagisto repository and security advisories at https://github.com/bagisto for published fix versions. Immediate workaround: disable or restrict access to the Downloadable Link Handler feature if not actively used by your business, reducing the attack surface from authenticated users. If the feature is required, implement strict input validation and URL whitelisting in the copy function to only allow URLs matching your internal trusted domains and block access to private IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, 127.0.0.1:9600 for internal service discovery). Network-level mitigation: restrict egress HTTP/HTTPS traffic from the Bagisto application server to only explicitly required external URLs, denying requests to internal networks and metadata services; this adds latency overhead if legitimate internal service calls are needed but significantly reduces SSRF impact. Apply input validation at the application code level: sanitize all URL parameters in the Downloadable Link Handler copy function to reject or escape potentially malicious schemes (file://, gopher://) and validate against a strict allowlist before constructing requests.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an atta
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today