CVE-2026-21448 is a critical server-side template injection (CVSS 9.8) in Bagisto before version 2.3.10. A normal customer can enter a value in the address step of checkout that is evaluated in the admin view, which can lead to remote code execution. Version 2.3.10 contains the fix.
What's affected
The record says Bagisto versions before 2.3.10 are affected and that 2.3.10 contains a patch. The GitHub advisory GHSA-5j4h-4f72-qpm6 names 2.3.9 as the affected version and v2.3.10 as patched. The weakness is CWE-1336 (improper neutralization of special elements used in a template engine). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The advisory describes a customer entering a value in an address field during checkout. That value is later rendered by the admin order view as if it were a template. The advisory says the impact can lead to remote code execution. It rates the issue High, while the NVD score is 9.8 critical.
The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check your Bagisto version.
grep -i bagisto composer.lock | head
If it is older than 2.3.10, treat the store as affected. Then look at stored customer addresses and order records for entries with odd template looking characters, such as paired curly braces or percent signs in name and address fields. A search of the address table for those characters is a quick signal.
If you find any, do not open the order in the admin view until the store is patched.
What to do now
- Upgrade Bagisto to 2.3.10 or later.
- Until then, avoid opening suspicious orders in the admin view, and consider limiting admin access to a VPN.
- Clean address and order fields that contain template syntax after you have patched.
- Rotate application and database secrets if you have any sign that the admin view evaluated hostile input.
- Apply the same upgrade for CVE-2026-21446 and CVE-2026-21450, which are fixed in the same release.
Why it matters
Server-side template injection happens when user input becomes part of a template that the server renders, instead of being treated as data. Template engines are powerful by design: they can call functions and read variables. Once the engine evaluates attacker text, the attacker can borrow that power, and on many engines that leads to code execution.
This case has a stored twist. The input is entered by a low privilege customer, but it fires later in the admin interface, in the context of a more trusted user and a more privileged process. That delay hides the bug from simple tests, and it raises the stakes. Data entered at one trust level and shown at another is a classic place for this class of bug.
The fix is to render user text as data and escape it on output. A static code scan that follows input to template sinks can find this, as the demo shows.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does a customer field reach the admin view?
The address is stored with the order, and the admin order page displays it. The bug is that the display treated stored text as template code.
Sources
Last reviewed: 19 October 2026.
