Vulnerability · Published Oct 10, 2025 · Assigned by mitre
CVE-2025-60880
High 8.3
In plain English
A high-severity cross-site scripting in the bagisto/bagisto package (Packagist). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | bagisto/bagisto | 2.3.7 | GHSA-29mf-w486-v3vc |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:L/PR:H/S:C/UI:R