High severity8.3NVD Advisory· Published Oct 10, 2025· Updated Jun 17, 2026
CVE-2025-60880
CVE-2025-60880
Description
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
bagisto/bagistoPackagist | >= 2.3.6, < 2.3.7 | 2.3.7 |
Affected products
3Patches
Vulnerability mechanics
References
5- gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-29mf-w486-v3vcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-60880ghsaADVISORY
- github.com/bagisto/bagisto/commit/9ec40c99c34a83f311ffbb7c1039a59ff9d655ccghsaWEB
- github.com/darylldoyle/svg-sanitizer/releasesghsaWEB
News mentions
0No linked articles in our index yet.