Which versions of Bagisto are affected by CVE-2026-9506?

Bagisto v2.4.1, a widely-deployed open-source e-commerce platform, contains an unauthenticated arbitrary file read vulnerability that allows attackers to extract sensitive files including database…

How to fix or mitigate CVE-2026-9506?

24 hours: Identify and inventory all Bagisto 2.4.1 instances in production and development; document data sensitivity and customer exposure. 7 days: Implement compensating controls including network-based access restrictions to ImageCacheController endpoints and WAF rules blocking path traversal patterns (../ and URL-encoded variants). 30 days: Execute upgrade path to latest Bagisto release when patches become available; if urgency requires sooner mitigation, evaluate disabling image cache functionality or transitioning to alternative e-commerce platform with security-hardened image handling.

Bagisto CVE-2026-9506

Q: What is the CVSS score of CVE-2026-9506?

CVE-2026-9506 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-35036 HIGH

Path Traversal (CWE-22)

2026-06-08 CERT-In

GHSA-qhcg-rw5x-vg94

Path Traversal Bagisto

8.7

CVSS 4.0 · Vendor: CERT-In

Severity by source

Vendor (CERT-In) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERT-In) · only source for this CVE.

CVSS VectorVendor: CERT-In

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:30 vuln.today

CVSS changed

Jun 08, 2026 - 10:22 NVD

8.7 (HIGH)

DescriptionCVE.org

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.

AnalysisAI

Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the web root by injecting path traversal sequences into the filename parameter of the ImageCacheController. The CVSS 4.0 base score of 8.7 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality impact, and no public exploit identified at time of analysis.

Technical ContextAI

Bagisto is an open-source Laravel-based e-commerce platform developed by Webkul (CPE: cpe:2.3:a:webkul:bagisto). The flaw is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal) within the ImageCacheController, a component that serves and caches product/media images. Because the controller takes a user-supplied filename and concatenates or resolves it against a base directory without canonicalizing or rejecting '../' sequences, attackers can break out of the intended image directory and reach any file readable by the PHP/web-server user (e.g., .env, config/database.php, storage logs, or system files like /etc/passwd).

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data; operators should consult the CERT-In advisory (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292) and the Bagisto GitHub repository for a fixed release beyond v2.4.1 and upgrade once published. As compensating controls, place a WAF rule or reverse-proxy filter that rejects requests to ImageCacheController routes containing '..', '%2e%2e', URL-encoded slashes, or absolute paths in the filename parameter (trade-off: may break legitimate image URLs that use unusual encoding); restrict the web-server user's filesystem permissions so it cannot read .env, config/, or storage/logs (trade-off: requires testing Laravel cache/log paths); and rotate APP_KEY, database, mail, and payment credentials proactively in case .env was already exposed.