Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload

Advisories

Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload

Severity: low
Date: 11/3/2026
Affecting: Bagisto >= 0, < 2.4.5
CVE: CVE-2026-121733
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS: 2.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References: Patch Commit
https://github.com/bagisto/bagisto
https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a99cf153ac338466720acd9004
https://github.com/bagisto/bagisto/blob/v2.4.4/packages/Webkul/Shop/src/Http/Controllers/Customer/Account/RMAController.php#L408
Bagisto v2.4.5 Release Notes
Credit: Muhammad Shariff, Devansh Bawari
Description: Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo