Read the docs
TI-2026-84854 Aliases CVE-2026-121733GHSA-j38w-r3vf-5255

Stored XSS in Bagisto RMA conversation attachment upload

Priority LOW 10CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Bagisto before 2.4.5 contains a stored cross-site scripting flaw in the RMA send-message endpoint, which accepts uploaded HTML files without type or extension validation (CWE-434). An authenticated customer with low privileges can upload an HTML attachment containing JavaScript that runs in the shop's origin when an administrator opens it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.

Why it matters now

EPSS 0.00182 7th percentileScored 2026-11-07
Fix Fixed Bagisto (Webkul): 2.4.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WebkulBagistobefore 2.4.52.4.5Patch availableCNA
  • Bagisto VendorWebkul Affected before 2.4.5 Fixed in 2.4.5 Patch available CNA

Remediation

Upgrade Webkul Bagisto to version 2.4.5 or later, which fixes this issue. The sources list no fixed version for any other product.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Bagisto (Webkul) Fixed in 2.4.5

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121733
  2. 2026-11-04 Alias added: GHSA-j38w-r3vf-5255

References

Patch 2

Other 3

  • TI-2025-41192 Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and… CVSS 3.1CRITICAL 9.8
  • TI-2017-14326 Joomla! Component Ajax Quiz 1.8 SQL Injection CVSS 4.0HIGH 8.8
  • TI-2026-17332 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product CVSS 4.0HIGH 8.9
  • TI-2023-16589 Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1HIGH 8.8
  • TI-2026-56886 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint CVSS 4.0HIGH 8.6
  • TI-2026-52873 Webkul QloApps SQL injection CVSS 4.0HIGH 8.6
See all 104 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences