CVE-2026-121733 in Bagisto
Summary
by MITRE • 11/04/2026
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The identified vulnerability represents a critical security flaw within versions of Bagisto prior to 2.4.5, specifically manifesting as a stored cross-site scripting issue rooted in inadequate input validation on file uploads. The core technical deficiency lies in the RMA send-message endpoint, which processes attachments submitted by authenticated customers without performing rigorous checks on file type or extension. This lack of sanitization allows an attacker to bypass standard security controls and upload arbitrary HTML files directly into the system's storage directory at /storage/rma-conversation/. By exploiting this gap, a malicious actor can inject executable JavaScript code disguised as a legitimate document attachment, effectively turning the customer support interface into a vector for persistent script injection.
From an operational perspective, the impact of this vulnerability is severe due to its stored nature and the specific target audience involved in the exploitation chain. Unlike reflected XSS attacks that require tricking a user into clicking a malicious link, this flaw persists on the server side until manually addressed by site administrators. When an administrator or support staff member opens the RMA conversation thread containing the poisoned HTML attachment, their browser executes the embedded JavaScript within the context of the shop's origin. This session-based execution grants the attacker full access to the administrative session cookies and tokens, potentially leading to complete account takeover, unauthorized modification of store settings, theft of sensitive customer data, or defacement of the e-commerce platform. The trust relationship between the administrator interface and the stored content is fundamentally broken by this flaw.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting weakness. Furthermore, from an offensive security framework perspective, it maps to MITRE ATT&CK technique T1059, specifically the execution of scripts via browser-based mechanisms, and falls under the broader category of client-side code injection. The exploitation path leverages social engineering principles by relying on the administrator's routine interaction with customer service records, making detection difficult without proactive monitoring or strict file upload policies.
To mitigate this risk, immediate action is required to upgrade Bagisto to version 2.4.5 or later where these validation checks have been implemented. In environments where upgrading is not immediately feasible, defensive measures should include implementing a robust allowlist for permitted file extensions on the RMA attachment endpoint, ensuring that only safe formats such as PDF and images are accepted. Additionally, applying strict Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting script execution sources. Input validation must be enforced both at the client side for user experience and critically at the server side to prevent malicious payloads from ever reaching storage systems. Regular security audits of file upload mechanisms across all endpoints are essential to maintain a secure e-commerce infrastructure.