Bagisto is vulnerable to XSS through Admin Panel's product creation path

Also known as GHSA-29mf-w486-v3vc

Published 12 mo ago 2025-10-10 · modified 3 d ago 2026-11-05 · JSON

CVSS

8.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 35%

Public exploits

none known

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 12 mo ago 2025-10-10

Exploit prediction (EPSS)

0.41% probability of exploitation in the next 30 days, higher than 35% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	8.3	`CVSS:3.1/AC:L/AV:N/A:H/C:H/I:L/PR:H/S:C/UI:R`
CNA	3.1	8.3	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H`
NVD	3.1	8.3	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H`
GitHub	3.1	8.3	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`bagisto/bagisto`	>=2.3.6, <2.3.7	2.3.7

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

gist.github.com /daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98
github.com /Shenal01/CVE-2025-60880
nvd.nist.gov /vuln/detail/CVE-2025-60880 · advisory
github.com /bagisto/bagisto/commit/9ec40c99c34a83f311ffbb7c1039a59ff9d655cc · web
github.com /bagisto/bagisto · package
github.com /darylldoyle/svg-sanitizer/releases · web

Sources

CVE List: CVE-2025-60880
GitHub Advisory: GHSA-29mf-w486-v3vc
NVD: CVE-2025-60880

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary