GitHub Advisoryadvisory · Packagist

GHSA-29mf-w486-v3vc Bagisto is vulnerable to XSS through Admin Panel's product creation path

HIGH Published 2025-10-10 Modified 2025-10-17 Official page ↗
Aliases
CVE-2025-60880
Ecosystem
Packagist
Packages
bagisto/bagisto
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H
Weaknesses
CWE-79
Reviewed
2025-10-13

Affected packages

• Packagist bagisto/bagisto: >= 2.3.6, < 2.3.7 → fixed in 2.3.7

Description

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Related

Alias · CVE (1)

  • CVE-2025-60880 An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References