PT-2025-42535 · Bagisto · Bagisto

Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-62416

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8

Description Bagisto is susceptible to Server-Side Template Injection (SSTI) because user-provided input isn't properly sanitized when processing product descriptions with the server-side templating engine. An attacker with product creation permissions can inject template expressions that the backend evaluates, potentially leading to Remote Code Execution (RCE). The product description field is passed to the view without adequate sanitization or escaping, allowing user data to execute arbitrary template code. Successful exploitation could allow attackers to execute arbitrary PHP code or system commands, read sensitive environment variables, API keys, or database credentials, deface the application, establish persistence, or escalate privileges.

Recommendations Update to Bagisto version 2.3.8 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-1336

Related Identifiers

CVE-2025-62416

GHSA-527Q-4WQV-G9WJ

Affected Products

Bagisto

References · 9

• 🔥 https://github.com/bagisto/bagisto/security/advisories/GHSA-527q-4wqv-g9wj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62416.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62416 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-527q-4wqv-g9wj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62416 · Security Note
• https://github.com/bagisto/bagisto · Note
• https://t.me/CVEtracker/35148 · Telegram Post
• https://twitter.com/CVEnew/status/1978926556840878099 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978959233694457991 · Twitter Post