Executive brief
Bagisto, an open-source e-commerce platform, contains a security flaw in how it handles image requests. An unauthorized person can exploit this to access sensitive files on the server, such as database passwords or configuration settings. This could lead to a full compromise of the online store and its customer data.
Technical details
A path traversal vulnerability (CWE-22) exists in Bagisto v2.4.1 within the ImageCacheController component. The flaw is caused by improper validation of user-supplied input in the 'filename' parameter. An unauthenticated remote attacker can exploit this by sending specially crafted requests containing directory traversal sequences (e.g., ../) to bypass intended directory restrictions. Successful exploitation allows the attacker to read sensitive system files, including application configurations and environment variables. The issue is resolved in version v2.4.2.
Affected products
- Webkul Bagisto v2.4.1
Timeline
- 2026-06-08: disclosed
- 2026-06-08: advisory
- 2026-06-08: patched: Patched in version v2.4.2