GitHub Advisoryadvisory · Packagist

GHSA-x3f9-vcp2-hgcw Bagisto affected by Server-Side Request Forgery

LOW Published 2026-04-21 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-6744
Ecosystem
Packagist
Packages
bagisto/bagisto
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-918
Reviewed
2026-05-06

Affected packages

• Packagist bagisto/bagisto: <= 2.3.15 (no fix yet)

Description

A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and explained: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."

Related

Alias · CVE (1)

  • CVE-2026-6744 A vulnerability was found in Bagisto up to 2.3.15. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References