PT-2026-6452 · Packagist · Bagisto/Bagisto

Publicado 2026-01-02 · Atualizado 2026-01-02

OSV

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

SSTI is possible via first name and last name parameters provided by lowest-privileged users.

Details

1. Go to http://127.0.0.1:8000/ and login or signup
2. Go to http://127.0.0.1:8000/customer/account/profile
3. Now edit the first name and last name to {{7*7}}
4. Notice it appears as 49

POC

• Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912

Impact

This can lead to RCE, command injection.

Correção

Enumeração de Fraquezas

CWE-1336

Identificadores relacionados

GHSA-MQHG-V22X-PQJ8

Produtos afetados

Bagisto/Bagisto

Referências · 6

• https://github.com/bagisto/bagisto · Nota
• https://github.com/bagisto/bagisto/security/advisories/GHSA-mqhg-v22x-pqj8 · Nota
• https://github.com/bagisto/bagisto/commit/4144931da0014c696f9126132ce44d7cfbdb2761 · Nota
• https://github.com/bagisto/bagisto/releases/tag/v2.3.10 · Nota
• https://osv.dev/vulnerability/GHSA-mqhg-v22x-pqj8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-21449 · Nota de Segurança