---
id: CVE-2026-121733
title: Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
summary: >-
  Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that
  allows authenticated customers to upload HTML files via the RMA send-message
  endpoint without type or extension validation. Attackers can upload a .html
  attac…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-434
vendor: Webkul
product: Bagisto
affected:
  - Bagisto < 2.4.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T18:58:00.446403Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:58:11.067Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121733'
references:
  - url: >-
      https://github.com/bagisto/bagisto/commit/204e43c26705b66ef2ddfb2a9eebb25f5e8f6a2c
    label: Patch Commit
  - url: 'https://github.com/bagisto/bagisto'
  - url: >-
      https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a99cf153ac338466720acd9004
  - url: >-
      https://github.com/bagisto/bagisto/blob/v2.4.4/packages/Webkul/Shop/src/Http/Controllers/Customer/Account/RMAController.php#L408
  - url: 'https://github.com/bagisto/bagisto/releases/tag/v2.4.5'
    label: Bagisto v2.4.5 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/bagisto-before-2.4.5-stored-xss-via-rma-conversation-attachment-upload
    label: >-
      VulnCheck Advisory: Bagisto before 2.4.5 Stored XSS via RMA Conversation
      Attachment Upload
tags:
  - cve.org
epss: 0.00182
epssPercentile: 0.07779
ingestedAt: '2026-11-05T21:36:00.513Z'
---

## Overview

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.

## Affected

- `Bagisto < 2.4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.