Executive brief
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
Affected products
- Packagist bagisto/bagisto
Junglewise Threat Intelligence
CVE-2026-21449: Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
CVE-2026-21449 · Severity: low · CVSS 3.1 · Published 2026-01-02
Technologies: bagisto/bagisto (Packagist). Vendors: Packagist.