PT-2025-41590 · Bagisto · Bagisto

Shenal01 · Published 2025-10-10 · Updated 2026-01-08 · CVE-2025-60880

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Bagisto version 2.3.6

Description An authenticated stored Cross-Site Scripting (XSS) issue exists in the admin panel's product creation functionality. An attacker can upload a crafted SVG file containing malicious JavaScript code. This allows execution of arbitrary JavaScript in the browser of an authenticated admin user, potentially leading to session hijacking or data theft. The vulnerability is triggered when the malicious SVG file is rendered. The affected path is the product creation process within the admin panel.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60880

GHSA-29MF-W486-V3VC

Affected Products

Bagisto

References · 14

• 🔥 https://gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98 · Exploit
• 🔥 https://github.com/Shenal01/CVE-2025-60880 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60880 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60880 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29mf-w486-v3vc · Vendor Advisory
• https://github.com/bagisto/bagisto · Note
• https://github.com/bagisto/bagisto/commit/9ec40c99c34a83f311ffbb7c1039a59ff9d655cc · Note
• https://github.com/darylldoyle/svg-sanitizer/releases · Note
• https://twitter.com/HackingTeam777/status/1977840286165586320 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o6h2pg/resumen_diario_de_vulnerabilidades_14102025 · Reddit Post
• https://t.me/cveNotify/148132 · Telegram Post
• https://twitter.com/CVEnew/status/1976723481640198297 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o5knot/resumen_diario_de_vulnerabilidades_13102025 · Reddit Post
• https://twitter.com/CveTodo/status/1976731557822882099 · Twitter Post