Bagisto vulnerabilities

2 known vulnerabilities in Bagisto from Webkul. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  Bagisto: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-9506Jun 8, 2026WebkulEPSS 1.38%

  This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component. An unauthenticated remote attacker could exploit this vulnerability by sending crafted path traversal sequences through the filename p

• 8.3 High severity

  Bagisto: Improper Neutralization of Input During Web Page Generation

  CVE-2025-60880Oct 10, 2025Webkul

  An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin use