PT-2026-34046 · Bagisto · Bagisto

Hai271120 · Published 2026-04-21 · Updated 2026-04-22 · CVE-2026-6744

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.16

Description An issue exists in the Downloadable Link Handler component within the copy() function. Remote manipulation of this function can lead to server-side request forgery, a flaw where an attacker can induce the server-side application to make requests to an unintended location.

Recommendations As a temporary workaround, consider restricting the use of the copy() function in the Downloadable Link Handler component until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6744

GHSA-X3F9-VCP2-HGCW

Affected Products

Bagisto

References · 9

• 🔥 https://drive.google.com/file/d/1pVSN3BYjI_rUE2Jms5EcIBGSMdrq6Wql/view?usp=sharing · Exploit
• https://osv.dev/vulnerability/GHSA-x3f9-vcp2-hgcw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6744 · Security Note
• https://github.com/bagisto/bagisto · Note
• https://vuldb.com/vuln/358435/cti · Note
• https://vuldb.com/vuln/358435 · Note
• https://vuldb.com/submit/794680 · Note
• https://twitter.com/VulmonFeeds/status/2046758767010643978 · Twitter Post
• https://twitter.com/CVEnew/status/2046675002112581850 · Twitter Post