CVE-2025-62416 — MEDIUM (5.1)

Vulnerability Description

Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.

CVSS Score

5.1

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Webkul	Bagisto	2.3.7

Related Weaknesses (CWE)

CWE-94 CWE-1336

References

https://github.com/bagisto/bagisto/security/advisories/GHSA-527q-4wqv-g9wjExploitVendor Advisory
https://github.com/bagisto/bagisto/security/advisories/GHSA-527q-4wqv-g9wjExploitVendor Advisory

FAQ

What is CVE-2025-62416?

CVE-2025-62416 is a vulnerability with a CVSS score of 5.1 (MEDIUM). Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating ...

How severe is CVE-2025-62416?

CVE-2025-62416 has been rated MEDIUM with a CVSS base score of 5.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-62416?

Check the references section above for vendor advisories and patch information. Affected products include: Webkul Bagisto.