EUVD-2026-60061
GHSA-w558-j9mq-crm3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because a customer account is required; UI:R and S:C because a second user must view the content and the impact crosses into their browser context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Cross-site scripting in Webkul Bagisto's RMA Message Handler (versions 2.4.0-2.4.4) allows authenticated customers to inject arbitrary JavaScript via the message argument at the /customer/account/rma/send-message endpoint, with execution occurring in the browser of any privileged user (e.g., store administrator) who reviews the RMA thread. A public proof-of-concept exploit is available on GitHub, lowering the exploitation barrier. The vendor has acknowledged the issues were already identified internally, with partial fixes applied and remaining items deferred to upcoming releases - no confirmed patched version has been published.
Technical ContextAI
Bagisto is an open-source Laravel/PHP-based e-commerce platform. The RMA (Return Merchandise Authorization) module provides customers a workflow to initiate product returns and communicate with store staff via threaded messages. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input from the message parameter at /customer/account/rma/send-message is not adequately sanitized or output-encoded before being rendered in an HTML context, allowing injected client-side script to persist and execute when the message thread is viewed. The CPE string cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:* confirms Webkul's Bagisto product across all sub-versions within the 2.4.x line (2.4.0 through 2.4.4) as affected per EUVD-2026-60061.
RemediationAI
No specific patched version number has been confirmed by the vendor or independently verified at time of analysis - the vendor states some issues have been addressed internally and remaining items are scheduled for upcoming releases. Users should monitor the official Bagisto GitHub repository and release notes for a patched version and upgrade immediately upon availability. As an interim compensating control, implement server-side input sanitization and output encoding on the message parameter in the RMA module; consider deploying a WAF rule to strip or HTML-encode script-bearing payloads submitted to /customer/account/rma/send-message (note: overly aggressive WAF rules may break legitimate rich-text message content). Additionally, restrict RMA message review interfaces to the minimum necessary administrator roles and consider alerting on unusual session activity for admin accounts. The POC is available at https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/39_english_vulnerability_report.md and can be used to validate whether a future patch is effective.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today