CVE-2025-62416: bagisto - Server Side Template Injection (SSTI) in Product Description

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-10-16 · updated 2026-10-19
Weakness: CWE-94

Description

Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.

Affected products

Webkul Bagisto: 2.3.7

References

https://github.com/bagisto/bagisto/security/advisories/GHSA-527q-4wqv-g9wj
https://github.com/bagisto/bagisto/security/advisories/GHSA-527q-4wqv-g9wj

Get alerted when CVE-2025-62416 or the next vulnerability affects your stack