CVE-2025-62416CWE-1336CWE-94code-injection

CVE-2025-62416

Medium · published October 16, 2025

CVSS v3.1
5.1
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.5th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-10-16T23:15Z
Affected products (1)
ProductVersionsFixed in
webkul/bagistoall versions—
References (2)
https://github.com/bagisto/bagisto/security/advisories/GHSA-527q-4wqv-g9wj · [email protected]https://github.com/bagisto/bagisto/security/advisories/GHSA-527q-4wqv-g9wj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 18:32Z
    bagisto - Server Side Template Injection (SSTI) in Product Description
    cvelistv5