CVE-2025-62418CWE-79CWE-80CWE-87cross-site-scripting

CVE-2025-62418

Medium · published October 16, 2025

CVSS v3.1
6.9
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.3th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS); CWE-87 · Improper Neutralization of Alternate XSS Syntax
Published
2025-10-16T23:15Z
Affected products (1)
ProductVersionsFixed in
webkul/bagistoall versions—
References (2)
https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346 · [email protected]https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 18:35Z
    bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)
    cvelistv5