CVE-2025-62418: bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-10-16 · updated 2026-10-19
Weakness: CWE-80

Description

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Affected products

Webkul Bagisto: 2.3.7

References

https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346
https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346

Get alerted when CVE-2025-62418 or the next vulnerability affects your stack