CVE-2026-21448 - Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

CVE ID : CVE-2026-21448 Published : Jan. 2, 2026, 9:15 p.m. | 52 minutes ago Description : Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch. Severity: 8.9 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor