CVE-2025-62417

Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim’s spreadsheet application — potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros). This vulnerability is fixed in 2.3.8.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/bagisto/bagisto/security/advisories/GHSA-jqrp-58fv-w8cq	Exploit Vendor Advisory
https://github.com/bagisto/bagisto/security/advisories/GHSA-jqrp-58fv-w8cq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:webkul:bagisto:2.3.7:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Bagisto es una plataforma de eCommerce laravel de código abierto. Cuando los datos de un producto que comienzan con un carácter de fórmula de hoja de cálculo (por ejemplo, =, +, -, o @) son aceptados y luego exportados o guardados en un CSV y abiertos en un software de hoja de cálculo, la hoja de cálculo interpretará esa celda como una fórmula. Esto permite a un atacante suministrar un campo CSV (por ejemplo, nombre del producto) que contiene una fórmula que puede ser evaluada por la aplicación de hoja de cálculo de una víctima - lo que podría llevar a la exfiltración de datos y a la ejecución remota de comandos (a través de exploits antiguos de Excel / construcciones OLE/cmd o macros de Excel). Esta vulnerabilidad está corregida en 2.3.8.

Information

Published : 2025-10-16 19:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-62417

Mitre link : CVE-2025-62417

CVE.ORG link : CVE-2025-62417

JSON object : View

Products Affected

webkul

bagisto

CWE

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

{"id": "CVE-2025-62417", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62417", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-17T14:32:45.377394Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"status": "affected", "version": "< 2.3.8"}]}]}], "published": "2025-10-16T19:15:34.650", "references": [{"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-jqrp-58fv-w8cq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-jqrp-58fv-w8cq", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1236"}]}], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim\u2019s spreadsheet application \u2014 potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros). This vulnerability is fixed in 2.3.8."}, {"lang": "es", "value": "Bagisto es una plataforma de eCommerce laravel de c\u00f3digo abierto. Cuando los datos de un producto que comienzan con un car\u00e1cter de f\u00f3rmula de hoja de c\u00e1lculo (por ejemplo, =, +, -, o @) son aceptados y luego exportados o guardados en un CSV y abiertos en un software de hoja de c\u00e1lculo, la hoja de c\u00e1lculo interpretar\u00e1 esa celda como una f\u00f3rmula. Esto permite a un atacante suministrar un campo CSV (por ejemplo, nombre del producto) que contiene una f\u00f3rmula que puede ser evaluada por la aplicaci\u00f3n de hoja de c\u00e1lculo de una v\u00edctima - lo que podr\u00eda llevar a la exfiltraci\u00f3n de datos y a la ejecuci\u00f3n remota de comandos (a trav\u00e9s de exploits antiguos de Excel / construcciones OLE/cmd o macros de Excel). Esta vulnerabilidad est\u00e1 corregida en 2.3.8."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webkul:bagisto:2.3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "991C244A-9DC2-431C-8ABC-BCF3AE81AD09"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}