Product: Bagisto
Affected versions: All versions prior to 2.3.10
Vulnerability type: Server-Side Template Injection (SSTI)
Impact: Remote Code Execution (RCE)
Severity: High
Attack complexity: Low
Privileges required:
- CVE-2026-21449: Low (authenticated customer user)
- CVE-2026-21450: Administrative context / exposed internal endpoint
User interaction: None
Exploit maturity: Proof-of-concept demonstrated
Patch available: Yes (official fix in version 2.3.10)
Overview
Two closely related security flaws were identified in Bagisto, an e-commerce platform built on the Laravel framework. Both vulnerabilities stem from unsafe handling of user-supplied input inside server-side template rendering logic.
When specific request parameters or profile fields are processed, the application fails to neutralize template expressions. As a result, attacker-controlled input is interpreted by the template engine rather than being treated as plain text. This behavior enables Server-Side Template Injection, which can escalate into remote code execution depending on the server configuration and available template functions.
Technical Root Cause
Bagisto uses a server-side templating engine to dynamically render views and reports. In vulnerable versions:
- Certain user-controlled values are passed directly into the rendering context
- No strict input validation or escaping is enforced before evaluation
- Template sandboxing is insufficient to prevent expression execution
Because of this, injected template syntax is evaluated at runtime on the server, not stored or displayed safely.
This is not a simple output encoding issue. The vulnerability occurs before rendering, during the compilation or evaluation phase of the template engine.
CVE-2026-21449 — Customer Profile SSTI
Attack Surface
first_namelast_name
These fields are editable by any authenticated customer account.
Exploitation Path
- Attacker registers or logs in as a standard customer
- Updates profile name fields with template expressions
- Application processes these fields inside a server-side template
- Expressions are evaluated instead of being treated as text
Security Impact
- Confirms arbitrary template evaluation
- Can escalate to:
- File read/write
- Environment variable exposure
- Command execution
- Webshell deployment (in permissive environments)
This makes it particularly dangerous because no administrative access is required.
CVE-2026-21450 — Report / Type Parameter SSTI
Attack Surface
typeparameter used in reporting or administrative views
Exploitation Path
- Attacker sends a crafted HTTP request to a reporting endpoint
- The
typeparameter is injected with template syntax - Server renders the parameter inside a template context
- Template engine executes attacker-supplied expressions
Security Impact
- Remote execution within administrative context
- Higher potential impact due to access to internal objects and services
- Easier lateral movement within the application
Why This Leads to Remote Code Execution
Server-side template engines often expose:
- Helper functions
- Object access
- File system utilities
- PHP execution primitives (direct or indirect)
Once an attacker confirms template evaluation, they can:
- Traverse application objects
- Call dangerous methods
- Chain template features to escape sandbox restrictions
Even if direct command execution is blocked, data exfiltration and persistent compromise are still realistic outcomes.
MITRE Mapping
CWE
- CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
ATT&CK Techniques
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1083 – File and Directory Discovery
- T1505 – Server-Side Component Injection
Indicators of Exploitation
Application Behavior
- Unexpected template output in rendered pages
- Profile fields displaying evaluated expressions instead of raw text
- Template rendering errors in application logs
Log Indicators
- HTTP requests containing template delimiters such as:
{{ }}{% %}
- Repeated profile updates with non-alphabetic name values
- Unusual report generation requests
Host Indicators
- New or modified files under web-accessible directories
- PHP processes spawned by the web server unexpectedly
- Scheduled tasks or cron jobs appearing without admin action
Detection Strategy
Recommended Log Sources
- Web server access logs (NGINX / Apache)
- Laravel application logs
- WAF logs
- Database audit logs
- OS process and file integrity monitoring logs
Detection Logic (Conceptual)
Web Requests
- Alert on POST requests where name fields or report parameters contain template syntax
- Correlate repeated attempts from the same IP or user
Application Logs
- Flag template parsing or rendering errors that reference user input
- Monitor for unexpected output types during rendering
Database Monitoring
- Detect profile fields containing characters typical of template expressions
Example Detection Rule
- Trigger when:
- User-editable fields contain template delimiters
- Request originates from non-admin accounts
- Occurs multiple times within a short timeframe
This should be implemented with careful tuning to avoid false positives.
Remediation
Immediate Action
- Upgrade Bagisto to version 2.3.10
This version introduces proper input handling and prevents template evaluation of untrusted data.
Official Patch
Bagisto 2.3.10 (official release)
https://github.com/bagisto/bagisto/releases/tag/v2.3.10
Temporary Mitigations (if upgrade is delayed)
- Sanitize all user input before rendering
- Reject template control characters in profile and report fields
- Restrict access to reporting endpoints
- Deploy WAF rules to monitor and block SSTI patterns
Incident Response Recommendations
If exploitation is suspected:
- Isolate the affected host
- Preserve logs and application state
- Inspect rendered templates and compiled cache files
- Search for unauthorized file creation or persistence mechanisms
- Rotate credentials and secrets
- Patch and redeploy from a clean source
Final Risk Assessment
These vulnerabilities represent a serious application-level security failure. SSTI issues are frequently underestimated, but they often lead directly to full system compromise. The presence of a working proof-of-concept, low attack complexity, and availability of a patch makes this a clear priority for remediation.
Any internet-facing Bagisto instance running a version below 2.3.10 should be considered at high risk until patched.
