High severityNVD Advisory· Published Oct 10, 2025· Updated Oct 17, 2025
CVE-2025-60880
CVE-2025-60880
Description
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
bagisto/bagistoPackagist | >= 2.3.6, < 2.3.7 | 2.3.7 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-29mf-w486-v3vcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-60880ghsaADVISORY
- gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98ghsaWEB
- github.com/bagisto/bagisto/commit/9ec40c99c34a83f311ffbb7c1039a59ff9d655ccghsaWEB
- github.com/darylldoyle/svg-sanitizer/releasesghsaWEB
News mentions
0No linked articles in our index yet.