CVE-2025-62418

PoC —

CVSS 3.1

4.8 medium

EPSS

<1%p18

Published

Oct 16, 2025 (Oct 16, 2025)

Modified

Jun 17, 2026

Description

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Vendors: webkul
Products: bagisto
Weakness: CWE-80, CWE-87, CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.