Executive Summary

CVE-2026-21449 is a Server-Side Template Injection (SSTI) vulnerability in the Bagisto e-commerce platform versions prior to 2.3.10. It allows a low-privileged user to inject template expressions into the first name and last name fields on their profile page. These expressions are evaluated by the server, which can lead to execution of arbitrary code or commands on the server. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with low privileges to execute arbitrary code or commands on the server hosting the Bagisto platform. This can lead to unauthorized access, data theft, server compromise, or disruption of services. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to inject template expressions into the "first name" and "last name" fields of a low-privilege user profile in Bagisto versions prior to 2.3.10. For example, entering a payload such as `{{7*7}}` and observing if the system evaluates and returns the result (e.g., 49) indicates the presence of the Server-Side Template Injection (SSTI) vulnerability. There are no specific network commands provided, but manual testing of these input fields with SSTI payloads is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Bagisto to version 2.3.10 or later, where the SSTI vulnerability has been fixed. Until the upgrade can be performed, restrict low-privilege user input in the "first name" and "last name" fields or apply input validation and sanitization to prevent template injection. [1]

Useful 0 Not Useful 0