CVE-2025-62415

Summary

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Affected Software

Weaknesses

• CWE-80: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CWE-87: CWE-87: Improper Neutralization of Alternate XSS Syntax

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/bagisto/bagisto/security/advisories/GHSA-67px-r26w-598x

References

• https://github.com/bagisto/bagisto/security/advisories/GHSA-67px-r26w-598x

• ←Previous
• Next→