CVE-2026-21449
Published: 02 January 2026
Summary
CVE-2026-21449 is a high-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Webkul Bagisto. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information input validation directly prevents server-side template injection by validating and sanitizing low-privilege user inputs in first name and last name fields before template processing.
Flaw remediation mandates timely patching to Bagisto version 2.3.10, which resolves the SSTI vulnerability.
Vulnerability monitoring and scanning identifies and remediates known issues like CVE-2026-21449 in the Bagisto platform.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSTI in public-facing web app directly enables remote code execution via T1190; resulting arbitrary command/script execution maps to T1059.
NVD Description
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.
Deeper analysisAI
CVE-2026-21449 is a server-side template injection vulnerability (CWE-1336) in Bagisto, an open-source Laravel eCommerce platform. The issue affects all versions prior to 2.3.10 and can be triggered via the first name and last name fields submitted by a low-privilege user.
A low-privilege authenticated user can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables high-impact compromise of confidentiality, integrity, and availability, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The official advisory from the Bagisto GitHub Security team at https://github.com/bagisto/bagisto/security/advisories/GHSA-mqhg-v22x-pqj8 confirms the vulnerability details, and upgrading to version 2.3.10 resolves the issue.
Details
- CWE(s)