EUVD-2026-24243
GHSA-65fp-7g2v-658r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
AnalysisAI
Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.
Technical ContextAI
The vulnerability resides in Bagisto's Custom Scripts Handler component, a feature that likely permits administrators or authenticated users to define custom JavaScript code within the application. The root cause is improper input validation and output encoding of user-supplied data (CWE-79: Improper Neutralization of Input During Web Page Generation), allowing attackers to bypass script sanitization and inject arbitrary HTML and JavaScript. The CVSS 4.0 vector indicates network accessibility (AV:N) with low attack complexity (AC:L), requiring authenticated user privileges (PR:L) and user interaction (UI:P) to trigger, with impact limited to user session integrity (VI:L). Because the component likely stores scripts server-side, this is a stored XSS variant rather than reflected, making it more persistent and dangerous across multiple user sessions.
RemediationAI
No vendor-released patched version is confirmed at time of analysis; vendor commits to fixes in upcoming releases (post-2.3.15). Immediately audit all custom scripts within the Custom Scripts Handler component and disable any that were not created by your organization or that exhibit suspicious code patterns. Apply input validation and output encoding mitigations at the application layer if source code access is available: enforce strict content-security-policy (CSP) headers to block inline script execution (trade-off: may break legitimate custom scripts relying on inline code), implement HTML entity encoding for all user-provided script content, and restrict Custom Scripts Handler access to only trusted administrator accounts via role-based access control. Enable HTTP-only and secure cookie flags to prevent JavaScript-based session theft. Monitor for suspicious script modifications and implement audit logging on the Custom Scripts Handler component. For maximum safety until a patched version is released, disable the Custom Scripts Handler feature entirely if business logic permits (verify with vendors of any extensions relying on this feature). Consult VulDB references (https://vuldb.com/vuln/358436) and GitHub security advisories for vendor-specific remediation guidance when available.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an atta
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today