Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121733Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload

Medium 5.4

In plain English

A medium-severity unrestricted file upload in Bagisto from Webkul. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 92.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.

Affected products (as reported)

Vendor	Product	Versions
Webkul	Bagisto	0 – before 2.4.5

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Patch Commit patch
https://github.com/bagisto/bagisto product
https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a99cf153ac338466720acd9004 patch
https://github.com/bagisto/bagisto/blob/v2.4.4/packages/Webkul/Shop/src/Http/Controllers/Customer/Account/RMAController.php#L408 technical-description
Bagisto v2.4.5 Release Notes release-notes
VulnCheck Advisory: Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload third-party-advisory