CVE-2025-62418 MEDIUM

CVE-2025-62418: bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

Vendor Bagisto
Product bagisto
Weakness CWE-80 · XSS · basic
Published October 16, 2025
Last update October 17, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Key dates

02Disclosure timeline

October 16, 2025 CVE published
October 17, 2025 Record updated