← CVE Intelligence

CVE-2025-62418

bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) PUBLISHED

Description (CNA)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Affected (CNA)

Vendor / productVersions
bagisto / bagistoaffected < 2.3.8

CWE

CWE-80, CWE-87

References

ADP enrichment

CISA-ADP

No English description supplied.