A critical stored XSS vulnerability in Bagisto 2.3.6 allows authenticated administrators to execute malicious scripts, posing a significant risk of session hijacking and unauthorized system control.

This is a stored cross-site scripting (XSS) vulnerability located in the product creation path of the admin panel. An authenticated admin user can upload a crafted SVG file containing malicious JavaScript, which executes in the context of the browser when viewed.

The ability for an authenticated administrator to execute arbitrary scripts can lead to full administrative session hijacking, unauthorized data exfiltration, and the modification of store configurations. Given the CVSS score of 8.3, this vulnerability carries a high risk of impact to organizational integrity and data confidentiality, as it effectively grants an attacker the ability to bypass intended security controls through a trusted administrative account.

Immediate Action: Update the Bagisto installation to version 2.3.7 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Audit administrative activity logs for irregular file uploads, particularly those involving SVG or other image formats that may contain embedded scripts.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) configured to inspect and sanitize file uploads for malicious payloads.

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub (Shenal01/CVE-2025-60880).

This vulnerability represents a significant security oversight in the product creation workflow of Bagisto 2.3.6. Organizations must prioritize upgrading to version 2.3.7 immediately to mitigate the risk of administrative account compromise. Failure to patch allows any compromised or malicious admin account to escalate their impact significantly through persistent script injection.