CVE-2026-21449

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21449", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T03:00:29.277Z", "datePublished": "2026-01-02T20:35:21.794Z", "dateUpdated": "2026-01-02T21:27:39.053Z"}, "containers": {"cna": {"title": "Bagisto has SSTI via first and last name from low-privilege user (not admin)", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/bagisto/bagisto/security/advisories/GHSA-mqhg-v22x-pqj8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-mqhg-v22x-pqj8"}], "affected": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"version": "< 2.3.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T20:35:21.794Z"}, "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue."}], "source": {"advisory": "GHSA-mqhg-v22x-pqj8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-02T21:27:20.253411Z", "id": "CVE-2026-21449", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-02T21:27:39.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21449", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-02T21:27:20.253411Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-02T21:27:30.570Z"}}], "cna": {"title": "Bagisto has SSTI via first and last name from low-privilege user (not admin)", "source": {"advisory": "GHSA-mqhg-v22x-pqj8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"status": "affected", "version": "< 2.3.10"}]}], "references": [{"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-mqhg-v22x-pqj8", "name": "https://github.com/bagisto/bagisto/security/advisories/GHSA-mqhg-v22x-pqj8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T20:35:21.794Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21449", "state": "PUBLISHED", "dateUpdated": "2026-01-02T21:27:39.053Z", "dateReserved": "2025-12-29T03:00:29.277Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-02T20:35:21.794Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bagisto", "vendor": "bagisto", "versions": [{"status": "affected", "version": "< 2.3.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9A19FD0-5100-48D6-BBB3-5A4CA1D90593", "versionEndExcluding": "2.3.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue."}, {"lang": "es", "value": "Bagisto es una plataforma de comercio electr\u00f3nico Laravel de c\u00f3digo abierto. Las versiones anteriores a la 2.3.10 son vulnerables a la inyecci\u00f3n de plantillas del lado del servidor a trav\u00e9s del nombre y apellido de un usuario con bajos privilegios. La versi\u00f3n 2.3.10 corrige el problema."}], "id": "CVE-2026-21449", "lastModified": "2026-06-17T10:18:41.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21449", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-02T21:27:20.253411Z", "version": "2.0.3"}}]}, "published": "2026-01-02T21:16:02.647", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-mqhg-v22x-pqj8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T20:12:14.504983+00:00", "value": {"mitigation_remediation": ["Upgrade Bagisto to version 2.3.10 or newer to apply the vendor\u2011provided fix.", "Sanitize or escape all user\u2011supplied first and last name inputs before rendering them within templates.", "Implement monitoring to detect suspicious template injection attempts and review logs for unauthorized code execution."], "summary": {"action": "Patch", "impact": "Remote Code Execution via Server\u2011Side Template Injection"}, "threat_synthesis": {"affected_systems": "The affected product is the Bagisto eCommerce platform. All releases prior to version 2.3.10 are impacted; version 2.3.10 and later contain the fix.", "description_and_impact": "Bagisto allows injection of template expressions through the first and last name fields supplied by low\u2011privilege users. The likely attack vector is a low\u2011privilege user creating or editing a customer profile to supply malicious payloads in the name fields. Based on the description, it is inferred that the unsanitized input is rendered by the server, enabling an attacker to execute arbitrary code within the application context. The vulnerability is classified as CWE\u20111336, server\u2011side template injection, which can compromise confidentiality, integrity, and availability of the platform.", "risk_and_exploitability": "The CVSS score of 7.4 indicates a high severity. EPSS is listed as less than 1%, suggesting a low current exploitation probability. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the flaw by creating or editing a customer profile, supplying malicious payloads in the name fields, and the server will evaluate them during template rendering."}}}}, "created": "2026-01-05T10:13:49.500052+00:00", "updated": "2026-04-18T20:15:09.558811+00:00", "vendors": ["webkul", "webkul$PRODUCT$bagisto"]}