← CVE Intelligence

CVE-2025-62416

bagisto - Server Side Template Injection (SSTI) in Product Description PUBLISHED

Description (CNA)

Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.

Affected (CNA)

Vendor / productVersions
bagisto / bagistoaffected < 2.3.8

CWE

CWE-94, CWE-1336

References

ADP enrichment

CISA-ADP

No English description supplied.