CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2026-21450

Shopping for Shells: Bagisto Reporting SSTI to RCE

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·5 min read·47 visits

Executive Summary (TL;DR)

Bagisto versions prior to 2.3.10 contain a logic flaw in how reporting metrics are rendered. By manipulating the 'type' parameter in the URL, an authenticated attacker (admin) can inject Laravel Blade syntax, leading to Remote Code Execution (RCE).

A critical Server-Side Template Injection (SSTI) vulnerability in the Bagisto eCommerce platform allows authenticated administrators to execute arbitrary code via the Reporting module.

Official Patches

BagistoCommit 3f294b4 fixing the SSTI vulnerability

Fix Analysis (1)

Technical Appendix

CVSS Score
7.3/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS Probability
0.04%
Top 100% most exploited
2,500
via Shodan

Affected Systems

Bagisto eCommerce < 2.3.10

Affected Versions Detail

Product
Affected Versions
Fixed Version
Bagisto
Webkul
< 2.3.102.3.10
AttributeDetail
CWECWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine)
CVSS 4.07.3 (High)
Attack VectorNetwork
PrivilegesHigh (Admin)
Exploit StatusPoC Available
ImpactRemote Code Execution (RCE)

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1210Exploitation of Remote Services
Lateral Movement
T1059.003Command and Scripting Interpreter: Windows Command Shell
Execution
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine

The application allows user input to control the template syntax that is rendered, enabling the injection of malicious directives.

Known Exploits & Detection

GitHub AdvisoryAdvisory containing PoC details for SSTI
NucleiDetection Template Available

Vulnerability Timeline

Vendor releases fix in commit 3f294b4
2025-12-24
CVE-2026-21450 Assigned
2026-01-02
Public Advisory Published
2026-01-02

References & Sources

  • [1]GHSA-9hvg-qw5q-wqwp
  • [2]CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•43 minutes ago•CVE-2026-49757
9.2

CVE-2026-49757: Authentication Bypass and Account Takeover in ash_authentication OAuth2/OIDC

An authentication bypass and account takeover vulnerability in the AshAuthentication Elixir library (developed by team-alembic) allows unauthenticated remote attackers to compromise local accounts. By relying on mutable and unverified email claims instead of stable cryptographic issuer and subject pairings during OAuth2 and OIDC federated login flows, the application fails to validate the trust boundary of the incoming session.

Alon Barad
Alon Barad
1 views•6 min read
•about 2 hours ago•CVE-2026-55618
6.5

CVE-2026-55618: URL Extraction Bypass via HTML Entities in eml_parser

A critical logical flaw in the eml_parser Python module prior to version 3.0.2 allows malicious URLs to evade automated security analysis pipelines. By encoding key URI delimiter characters as HTML decimal entities, an attacker can mask indicators of compromise. Security controls, orchestration layers, and sandbox systems fail to detect these links, while downstream Mail User Agents natively reconstruct the malicious hyper-references when processed by end-users. This mechanism undermines the integrity of automated indicator extraction processes within Security Operations Centers.

Amit Schendel
Amit Schendel
3 views•7 min read
•about 3 hours ago•CVE-2026-55619
5.3

CVE-2026-55619: Parser Denial of Service via Deeply Nested Parentheses in E-mail Headers

A denial of service vulnerability in GOVCERT-LU eml_parser before version 3.0.2 allows unauthenticated remote attackers to trigger an unhandled RecursionError exception. The issue arises during the parsing of structured email headers containing excessively nested parentheses representing Comments and Folding White Space (CFWS). Because the parser fails to catch this recursion-limit exception from Python's standard library, processing of the entire mail immediately aborts, which can disrupt automated security triage pipelines and email ingestion components.

Alon Barad
Alon Barad
3 views•6 min read
•about 4 hours ago•CVE-2026-55620
7.5

CVE-2026-55620: Algorithmic Complexity Denial of Service in GOVCERT-LU eml_parser

Prior to version 3.0.2, GOVCERT-LU's eml_parser library is vulnerable to an algorithmic complexity Denial of Service (DoS) vulnerability via the comment-stripping routine noparenthesis() in routing.py. An unauthenticated attacker can submit a crafted EML file containing nested parenthesized comments to cause complete CPU saturation. This happens due to a quadratic time complexity bottleneck in regex replacement of nested structures.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 5 hours ago•CVE-2026-55629
8.7

CVE-2026-55629: Arbitrary File Read via Path Traversal in Whistle Proxy Internal Service

Whistle prior to version 2.10.3 contains a path traversal vulnerability in its internal service layer. An unauthenticated remote attacker can read arbitrary files on the hosting operating system by issuing a crafted GET request containing relative or absolute file paths to the `/cgi-bin/temp/get` endpoint. This behavior occurs because the application fails open when an input file parameter does not match the temporary file format regex.

Alon Barad
Alon Barad
4 views•6 min read
•about 6 hours ago•CVE-2026-55609
7.1

CVE-2026-55609: Arbitrary File Read and Write via Model Context Protocol (MCP) Tools in sublinear-time-solver and consciousness-explorer

An arbitrary file read and write vulnerability exists in the Model Context Protocol (MCP) server endpoints of sublinear-time-solver and consciousness-explorer. By providing unvalidated file paths to the export_state, import_state, saveVectorToFile, and loadVectorFromFile tools, local attackers can read or overwrite sensitive host files.

Alon Barad
Alon Barad
3 views•5 min read