7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21450

CVE-2026-21450: Bagisto has SSTI in parameter that can lead to RCE

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21450

CVE-2026-21450:

7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bagisto/bagisto	composer	< 2.3.10	2.3.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Template Injection (SSTI) located in the reporting module of the Bagisto admin panel. The analysis of the provided patch commit 3f294b4837595929107d9c1bbd6d5b1222ef9fea reveals that the root cause is the unsafe use of user-controlled input to dynamically determine method calls.

The functions stats, viewStats, and export within the Webkul\Admin\Http\Controllers\Reporting\Controller class all used the type query parameter directly from the HTTP request (request()->query('type')) to look up a method name in the $this->typeFunctions array and then invoke it. There was no validation to ensure that the type parameter corresponded to an expected, safe value.

An attacker could exploit this by crafting a request where the type parameter contains a malicious template payload (e.g., {{7*7}}). When the application processes this input to generate a response, the template engine would execute the payload, leading to arbitrary code execution on the server. The patch rectifies this by introducing a new resolveTypeFunction method that validates the type parameter against a strict allowlist of known, safe function names before it is used, thus preventing the injection of malicious code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.