CVE-2025-62418

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

CVSS v3 6.9 MEDIUM

6.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346	Exploit Vendor Advisory
https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:webkul:bagisto:2.3.7:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Bagisto es una plataforma de comercio electrónico laravel de código abierto. En Bagisto v2.3.7, la funcionalidad de carga de imágenes de TinyMCE permite a un atacante con privilegios suficientes (p. ej., administrador) subir un archivo SVG manipulado que contiene JavaScript incrustado. Cuando se visualiza, el código malicioso se ejecuta en el contexto del navegador del administrador/usuario. Esta vulnerabilidad se corrige en la versión 2.3.8.

Information

Published : 2025-10-16 19:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-62418

Mitre link : CVE-2025-62418

CVE.ORG link : CVE-2025-62418

JSON object : View

Products Affected

webkul

bagisto

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-87

Improper Neutralization of Alternate XSS Syntax

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-62418", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62418", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-17T14:31:17.545230Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bagisto", "product": "bagisto", "versions": [{"status": "affected", "version": "< 2.3.8"}]}]}], "published": "2025-10-16T19:15:34.803", "references": [{"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bagisto/bagisto/security/advisories/GHSA-fg89-g389-p346", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}, {"lang": "en", "value": "CWE-87"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user\u2019s browser. This vulnerability is fixed in 2.3.8."}, {"lang": "es", "value": "Bagisto es una plataforma de comercio electr\u00f3nico laravel de c\u00f3digo abierto. En Bagisto v2.3.7, la funcionalidad de carga de im\u00e1genes de TinyMCE permite a un atacante con privilegios suficientes (p. ej., administrador) subir un archivo SVG manipulado que contiene JavaScript incrustado. Cuando se visualiza, el c\u00f3digo malicioso se ejecuta en el contexto del navegador del administrador/usuario. Esta vulnerabilidad se corrige en la versi\u00f3n 2.3.8."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webkul:bagisto:2.3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "991C244A-9DC2-431C-8ABC-BCF3AE81AD09"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}