https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 08:07:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-255326 EUVD-2026-255326 https://cve.radiocsirt.org/vuln/euvd-2026-255326 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62416 <p>Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.</p> <p>Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-62416 https://cve.radiocsirt.org/vuln/ghsa-527q-4wqv-g9wj <p><strong>Affected:</strong> Packagist: bagisto/bagisto</p> <p>### Summary Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server.</p> <p>### Details In Bagisto, product descriptions are rendered through Laravel’s Blade templating engine in various front-end and admin views. The product description field is not sanitized or escaped before being passed to the view, which means user-supplied data can break out of the expected string context and execute arbitrary template code.</p> <p>### PoC Create a product and enter the payload to the description. &lt;img width=&#34;679&#34; height=&#34;669&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/1e5dac3f-4043-4b31-98ed-f4346feb5477&#34; /&gt; Preview the page, observed that the template expressions were evaluated by the backend and displayed on the screen. &lt;img width=&#34;1431&#34; height=&#34;922&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/16f29c6e-05f4-40c4-9926-0c59e0a979c2&#34; /&gt;</p> <p>### Impact RCE potential: Attackers can execute arbitrary PHP code or system commands. Data breach: Read sensitive environment variables (.env), API keys, or database credentials. Defacement / persistence: Inject malicious scripts or backdoors in dynamic templates. Privilege escalation: If attackers have…</p> <p><strong>Affected:</strong> Packagist: bagisto/bagisto</p> <p>### Summary Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server.</p> <p>### Details In Bagisto, product descriptions are rendered through Laravel’s Blade templating engine in various front-end and admin views. The product description field is not sanitized or escaped before being passed to the view, which means user-supplied data can break out of the expected string context and execute arbitrary template code.</p> <p>### PoC Create a product and enter the payload to the description. &lt;img width=&#34;679&#34; height=&#34;669&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/1e5dac3f-4043-4b31-98ed-f4346feb5477&#34; /&gt; Preview the page, observed that the template expressions were evaluated by the backend and displayed on the screen. &lt;img width=&#34;1431&#34; height=&#34;922&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/16f29c6e-05f4-40c4-9926-0c59e0a979c2&#34; /&gt;</p> <p>### Impact RCE potential: Attackers can execute arbitrary PHP code or system commands. Data breach: Read sensitive environment variables (.env), API keys, or database credentials. Defacement / persistence: Inject malicious scripts or backdoors in dynamic templates. Privilege escalation: If attackers have…</p> https://cve.radiocsirt.org/vuln/ghsa-527q-4wqv-g9wj