VULNERABILITY INTELLIGENCE

CVE-2025-62416

CVSS score5.1 MEDIUM
EPSS probability0.40%
CISA KEVNot currently listed
Published2025-10-16
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

Description

Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Primary references