PT-2025-42536 · Bagisto · Bagisto

Published 2025-10-16 · Updated 2025-10-17 · CVE-2025-62417

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8

Description The application does not neutralize or escape leading formula characters when generating CSV files or accepting CSV import fields. This allows an attacker to supply a CSV field, such as a product name, that contains a formula. When a user opens the CSV file in spreadsheet software, the spreadsheet will interpret and evaluate the content, potentially leading to data exfiltration and remote command execution through older Excel exploits or macros. The issue occurs when product data beginning with a spreadsheet formula character (e.g., =, +, -, or @) is accepted and later exported or saved into a CSV file. The affected API endpoint is '/admin/catalog/products/edit/1'. The vulnerable parameter is the product name field.

Recommendations Versions prior to 2.3.8 should be updated to version 2.3.8 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2025-62417

GHSA-JQRP-58FV-W8CQ

Affected Products

Bagisto

References · 10

• 🔥 https://github.com/bagisto/bagisto/security/advisories/GHSA-jqrp-58fv-w8cq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62417.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62417 · Security Note
• https://osv.dev/vulnerability/GHSA-jqrp-58fv-w8cq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62417 · Vendor Advisory
• https://github.com/bagisto/bagisto · Note
• https://github.com/bagisto/bagisto/commit/8076c708498a0187bc952d5f5f705e0cb1919682 · Note
• https://reddit.com/r/VulnMatter/comments/1o91x4z/resumen_diario_de_vulnerabilidades_17102025 · Reddit Post
• https://t.me/CVEtracker/35149 · Telegram Post
• https://twitter.com/CVEnew/status/1978926557885321681 · Twitter Post