CVE-2026-21450 is a critical server-side template injection (CVSS 9.8) in Bagisto before version 2.3.10, through the type parameter of an admin reporting page. It can lead to remote code execution or other exploitation. Version 2.3.10 fixes it, so upgrade and block outside access to the admin area.
What's affected
The record says Bagisto versions before 2.3.10 are affected and that 2.3.10 fixes the issue. The GitHub advisory GHSA-9hvg-qw5q-wqwp names version 2.3.9 as affected and v2.3.10 as patched. The weakness is CWE-1336 (improper neutralization of special elements used in a template engine). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The advisory shows the issue in the admin reporting products view, where the type value in the address is rendered by the template engine. It rates the issue High, while the NVD score is 9.8 critical with no privileges required. The difference matters, because the page sits in the admin area: whether it needs a login in your setup depends on how you run the store, so do not rely on that. The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check the version.
grep -i bagisto composer.lock | head
Anything older than 2.3.10 is affected. Then review your web server logs for requests to the admin reporting pages with odd looking type values, such as curly braces or percent signs, and check who made them. Also check whether the admin path is open to the public internet.
What to do now
- Upgrade Bagisto to 2.3.10 or later.
- Restrict the admin path to a VPN or an address allowlist.
- Review admin accounts and sessions, and end any you do not recognise.
- Rotate secrets if logs show hostile values in the reporting URLs.
- Apply the same upgrade for CVE-2026-21446 and CVE-2026-21448.
Why it matters
Like its sibling, this is template injection: a value from the request reaches the template engine as code instead of as data. Here the value comes in on a URL parameter, so a single link can carry it. Query parameters feel harmless to developers because they are only used to pick a view, and that is why they are so often passed into rendering without a check.
Three separate records in one release suggests a pattern in how the project builds views. A fix for each one is useful. A review of every place where request values flow into a template is better.
Whether an issue is worth your attention first depends on whether it can be reached. The demo shows how an exploitability check helps with that ranking.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this the same bug as CVE-2026-21448?
It is the same class of weakness in a different place. CVE-2026-21448 comes through checkout address data, and this one comes through a report parameter. The same upgrade fixes both.
Sources
Last reviewed: 19 October 2026.
