Executive Summary

CVE-2026-21448 is a Server-Side Template Injection (SSTI) vulnerability in Bagisto versions prior to 2.3.10. It occurs when a normal customer places an order and injects malicious template expressions during the 'add address' step. These injected expressions are then rendered and executed in the admin panel's sales orders view, allowing the attacker to execute arbitrary code remotely. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution (RCE) on the server from a low-privilege user context. An attacker can inject malicious code during the checkout process, which is then executed in the admin interface, potentially compromising the entire system, leading to data breaches, system takeover, or other severe security impacts. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by attempting to inject template expressions such as `{{7*7}}` into the address input fields during the 'add address' step of the checkout process. If the injected expression is rendered and evaluated in the admin panel's sales orders section (e.g., displaying '49'), the system is vulnerable. Specific commands depend on your environment, but you can test by placing an order with the payload `{{7*7}}` in address fields and then checking the admin interface for execution results. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Bagisto to version 2.3.10 or later, where this vulnerability has been patched. [1]

Useful 0 Not Useful 0