CVE-2025-60880
📋 TL;DR
An authenticated stored XSS vulnerability in Bagisto 2.3.6 allows admin users to upload malicious SVG files containing JavaScript code. When viewed, this code executes in victims' browsers, potentially compromising admin sessions and enabling unauthorized actions. Only authenticated admin users can exploit this vulnerability.
💻 Affected Systems
- Bagisto
📦 What is this software?
Bagisto by Webkul
⚠️ Risk & Real-World Impact
Worst Case
Complete admin account takeover leading to full system compromise, data exfiltration, or ransomware deployment across the e-commerce platform.
Likely Case
Session hijacking of other admin users, theft of sensitive customer data, or unauthorized modifications to products/orders.
If Mitigated
Limited impact with proper admin user vetting and monitoring, though still poses insider threat risk.
🎯 Exploit Status
Exploitation requires authenticated admin access; public proof-of-concept demonstrates SVG file creation and upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.7 or later
Vendor Advisory: https://github.com/bagisto/bagisto/security/advisories
Restart Required: No
Instructions:
1. Update Bagisto to version 2.3.7 or later. 2. Run composer update. 3. Clear application cache. 4. Verify SVG upload validation is working.
🔧 Temporary Workarounds
Disable SVG uploads
allTemporarily disable SVG file uploads in product creation
Modify Bagisto configuration to restrict file uploads to non-SVG formats
Implement content security policy
allAdd CSP headers to restrict script execution from uploaded files
Add Content-Security-Policy header with script-src 'self'
🧯 If You Can't Patch
- Implement strict admin user access controls and monitoring
- Deploy web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running Bagisto 2.3.6 and test SVG upload with JavaScript payload in product creationCheck Version:
php artisan bagisto:versionVerify Fix Applied:
Verify version is 2.3.7+ and test that SVG files with script tags are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads in admin logs
- Multiple failed login attempts followed by SVG upload
Network Indicators:
- Unusual outbound connections after admin panel access
- SVG files with script tags in upload traffic
SIEM Query:
source="bagisto_logs" AND (event="file_upload" AND file_extension="svg")