Live › vulnerability › CVE-2026-121733
Bagisto, a Laravel e-commerce platform, lets logged-in customers upload HTML files as RMA message attachments without checking the file type. A malicious HTML attachment runs JavaScript in the shop's origin when an administrator opens it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Shops running Bagisto before 2.4.5 that use the RMA (return merchandise authorization) messaging feature, where customers can attach files. The risk is to administrators who open the attachment in the admin panel, so exposure depends on whether RMA is enabled and whether uploads are served from the public storage path. Stores on a newer version or without RMA can skip it.
No product ranges from the sources yet.
composer.lock or the installed bagisto/bagisto package; versions before 2.4.5 are affected./storage/rma-conversation/ path on the shop and see whether uploaded files are served from it.2.4.5 or later (per the advisory's 'before 2.4.5' range).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.
This page as .md · .json · in your agent: get_signal("CVE-2026-121733")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.