CVE-2026-21448
Server-Side Template Injection in Bagisto Leads to RCE
Publication date: 2026-01-02
Last updated on: 2026-01-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bagisto | bagisto | to 2.3.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1336 | The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-21448 is a Server-Side Template Injection (SSTI) vulnerability in Bagisto versions prior to 2.3.10. It occurs when a normal customer places an order and injects malicious template expressions during the 'add address' step. These injected expressions are then rendered and executed in the admin panel's sales orders view, allowing the attacker to execute arbitrary code remotely. [1]
How can this vulnerability impact me? :
This vulnerability can lead to remote code execution (RCE) on the server from a low-privilege user context. An attacker can inject malicious code during the checkout process, which is then executed in the admin interface, potentially compromising the entire system, leading to data breaches, system takeover, or other severe security impacts. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by attempting to inject template expressions such as `{{7*7}}` into the address input fields during the 'add address' step of the checkout process. If the injected expression is rendered and evaluated in the admin panel's sales orders section (e.g., displaying '49'), the system is vulnerable. Specific commands depend on your environment, but you can test by placing an order with the payload `{{7*7}}` in address fields and then checking the admin interface for execution results. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Bagisto to version 2.3.10 or later, where this vulnerability has been patched. [1]