CVE-2025-62417
BaseFortify
Publication date: 2025-10-16
Last updated on: 2025-10-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webkul | bagisto | 2.3.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1236 | The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Bagisto, an open source Laravel eCommerce platform, when product data starting with spreadsheet formula characters (such as =, +, -, or @) is accepted and later exported or saved into a CSV file. When this CSV is opened in spreadsheet software, the software interprets these cells as formulas. An attacker can exploit this by supplying a CSV field containing a malicious formula, which may be evaluated by the victim's spreadsheet application, potentially leading to data exfiltration or remote command execution through older Excel exploits or macros.
How can this vulnerability impact me? :
This vulnerability can lead to serious impacts including unauthorized data exfiltration and remote command execution on the victim's system. If a user opens a maliciously crafted CSV file exported from Bagisto, their spreadsheet software might execute harmful formulas or macros, potentially compromising sensitive data or allowing attackers to run commands remotely on the user's machine.
What immediate steps should I take to mitigate this vulnerability?
Update Bagisto to version 2.3.8 or later, where this vulnerability is fixed. Additionally, avoid opening CSV files from untrusted sources in spreadsheet software without proper sanitization, especially if the CSV fields may begin with spreadsheet formula characters such as =, +, -, or @.