CVE-2026-6744 Details
Description
A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
A server-side request forgery (SSRF) vulnerability has been identified in Bagisto versions through 2.3.15, specifically within the Downloadable Link Handler component. This vulnerability allows authenticated users with permission to manage downloadable products to input arbitrary URLs for downloadable links. The application fails to properly validate these URLs, which are later fetched by the server using PHP's copy() function when a customer downloads the product. This exploitation can lead to unauthorized access to internal network resources or local files via the file:// protocol or direct filesystem paths.
It is recommended to restrict downloadable URL links to only allow http and https protocols, rejecting file:// URLs, local paths, and unsupported stream wrappers. DNS resolution should be used to block loopback, private, link-local, and reserved IP ranges. URLs should be re-validated at the time of download, not just when saving. If external URLs are not needed, consider removing URL-based downloadable links altogether and allow only uploaded files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 21, 2026CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.google.com/file/d/1pVSN3BYjI_rUE2Jms5EcIBGSMdrq6Wql/view?usp=sharing | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/submit/794680 | [email protected] | Technical Description |
| https://vuldb.com/vuln/358435 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358435/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bagisto | <= 2.3.15 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |