EUVD-2026-35036
GHSA-qhcg-rw5x-vg94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Bagisto storefront
-
DeliveryCraft filename with ../ traversal
-
ExploitSend GET to ImageCacheController
-
ExecutionServer returns out-of-scope file
-
ImpactHarvest .env secrets and credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that a Bagisto v2.4.1 instance be network-reachable and serving the vulnerable ImageCacheController image endpoint, which is enabled in the default storefront configuration; no authentication, no user interaction, and no special privileges are needed (CVSS AV:N/AC:L/PR:N/UI:N). Exploitation is limited by what files the PHP/web-server process can read on disk - files outside that user's read scope (e.g., root-owned secrets) and deployments behind a WAF that normalizes '../' sequences will not be reachable, and impact is confined to disclosure since the vector lacks integrity or availability impact. |
| Impact | Risk is meaningful but bounded to confidentiality. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) confirms a remote, unauthenticated, low-complexity attack with high confidentiality impact and no integrity or availability damage, yielding a score of 8.7. There is no EPSS score, no SSVC decision, and no CISA KEV listing supplied, and no public POC has been identified at the time of analysis - exploitation status is therefore not 'actively exploited' despite the high CVSS. The disclosure originates from CERT-In (CIVN-2026-0292) and is mirrored in ENISA EUVD-2026-35036, indicating government-CERT-grade validation rather than vendor-confirmed exploitation. Practical risk is elevated for internet-facing Bagisto storefronts because exfiltrating the Laravel .env file typically exposes APP_KEY, database credentials, and mail/payment API tokens, which can be pivoted to full compromise - so confidentiality-only impact understates downstream consequences. |
| Exploit ScenarioDerived | An attacker scans the internet for Bagisto storefronts, then issues an unauthenticated GET request to the ImageCacheController endpoint with a filename parameter such as '../../../../.env' or '../../../../etc/passwd'. The server returns the file contents, leaking the Laravel APP_KEY, database credentials, SMTP secrets, and payment gateway API keys, which the attacker uses to forge sessions, dump the customer database, or pivot deeper into the merchant's infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the web root by injecting path traversal sequences into the filename parameter of the ImageCacheController. The CVSS 4.0 base score of 8.7 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality impact, and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis in the supplied data; operators should consult the CERT-In advisory (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292) and the Bagisto GitHub repository for a fixed release beyond v2.4.1 and upgrade once published. As compensating controls, place a WAF rule or reverse-proxy filter that rejects requests to ImageCacheController routes containing '..', '%2e%2e', URL-encoded slashes, or absolute paths in the filename parameter (trade-off: may break legitimate image URLs that use unusual encoding); restrict the web-server user's filesystem permissions so it cannot read .env, config/, or storage/logs (trade-off: requires testing Laravel cache/log paths); and rotate APP_KEY, database, mail, and payment credentials proactively in case .env was already exposed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bagisto is an open-source Laravel-based e-commerce platform developed by Webkul (CPE: cpe:2.3:a:webkul:bagisto). The flaw is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal) within the ImageCacheController, a component that serves and caches product/media images. Because the controller takes a user-supplied filename and concatenates or resolves it against a base directory without canonicalizing or rejecting '../' sequences, attackers can break out of the intended image directory and reach any file readable by the PHP/web-server user (e.g., .env, config/database.php, storage logs, or system files like /etc/passwd).
Know when Bagisto gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (CERT-In) · only source for this CVE.
CVSS VectorVendor: CERT-In
Lifecycle Timeline
1DescriptionCVE.org
This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename parameter to access arbitrary files outside the intended directory on the targeted system.
Successful exploitation of this vulnerability could allow an attacker to read arbitrary sensitive files on the targeted system.
Executive ViewAI
Bagisto v2.4.1, a widely-deployed open-source e-commerce platform, contains an unauthenticated arbitrary file read vulnerability that allows attackers to extract sensitive files including database credentials, configuration secrets, and customer data outside the web root. Organizations running this version face immediate risk of data breach without requiring any attacker authentication or user interaction, directly threatening customer trust and regulatory compliance.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to ImageCacheController to trusted IP ranges only; (2) Deploy WAF rules to block path traversal attempts in filename parameters; (3) Apply filesystem hardening-restrict web server process privileges and segregate sensitive files outside web-accessible directories; (4) Enable request/response logging and establish monitoring alerts for suspicious file access patterns; (5) Review and disable image cache feature if not operationally critical until patched version is available; (6) Establish communication with Bagisto maintainers regarding patch ETA to inform remediation timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
CSV formula injection in Bagisto through 2.3.7 allows a user who can create or edit product data to store spreadsheet fo
Server-side template injection in Bagisto 2.3.7 lets an authenticated backend user with product-creation privileges inje
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Exploit-DB