CVE-2025-62418mediumCWE-80CWE-87

CVE-2025-62418: medium-severity vulnerability in bagisto

bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Published · Updated

Follow this CVE+ Monitor bagisto+ Monitor bagisto/bagisto

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Affected products
bagisto · bagisto
Related CVEs — bagisto

In the same product, most dangerous first.

CVE-2026-21450HIGHBagisto has SSTI in parameter that can lead to RCEEPSS 1.4%CVE-2026-21448HIGHBagisto has Normal & Blind SSTI from low-privilege user when ordering productEPSS 0.9%CVE-2026-21446HIGHBagisto Missing Authentication on Installer API EndpointsEPSS 0.6%CVE-2026-21451MEDIUMBagisto has HTML Filter Bypass that Enables Stored XSSEPSS 0.6%CVE-2026-21449HIGHBagisto has SSTI via first and last name from low-privilege user (not admin)EPSS 0.5%CVE-2025-62416MEDIUMbagisto - Server Side Template Injection (SSTI) in Product DescriptionEPSS 0.4%