PT-2025-42534 · Bagisto · Bagisto

Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-62415

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8

Description The TinyMCE image upload functionality in Bagisto allows an attacker with sufficient privileges to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. The application attempts to block HTML file uploads, but if the backend detects HTML or JavaScript content within a .png file, the file extension is automatically converted to .html. This allows the execution of JavaScript code when the HTML file is viewed. An attacker with upload privileges can target other admin users or editors who view the content, potentially leading to session hijacking, unauthorized actions, or privilege escalation.

Recommendations Update to Bagisto version 2.3.8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-87

CWE-79

Related Identifiers

CVE-2025-62415

GHSA-67PX-R26W-598X

Affected Products

Bagisto

References · 10

• 🔥 https://github.com/bagisto/bagisto/security/advisories/GHSA-67px-r26w-598x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62415.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62415 · Security Note
• https://osv.dev/vulnerability/GHSA-67px-r26w-598x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62415 · Vendor Advisory
• https://github.com/bagisto/bagisto · Note
• https://github.com/bagisto/bagisto/commit/7b6b1dd639a14e7053bb82ef2f971c1f533fdfab · Note
• https://twitter.com/CVEnew/status/1978926553745498523 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978961793583030677 · Twitter Post
• https://t.me/CVEtracker/35147 · Telegram Post