Threats affecting pkg:composer/bagisto/bagisto

A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."

CVE-2026-6744 is a server-side request forgery (SSRF) vulnerability in Bagisto versions up to 2.3.15. It affects the copy function of the Downloadable Link Handler component. The vulnerability can be exploited remotely without user interaction and has a medium severity rating with a CVSS 4.0 score of 5.3. The vendor has acknowledged the issue and plans to address it in upcoming releases but has not yet provided an official patch. Exploit details have been made public, but no known exploits are reported in the wild at this time.