CVE-2026-121733

Medium

Description

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Bagisto

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-434Unrestricted upload of dangerous file type

How to fix

Update

Webkul Bagisto2.4.5 or later

Patches

Vendor advisories

github.com/bagisto/bagisto/releases/tag/v2.4.5

Affected products

Product	Affected versions	Fixed in
Webkul Bagisto	v < 2.4.5	2.4.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.