CVE-2026-79410 Details

A vulnerability in Webkul Bagisto versions 2.4.9 and 2.4.10 has been identified, allowing authenticated attackers to manipulate their order total by submitting negative quantities through the add-to-cart functionality. This issue arises because the quantity parameter is not properly validated, enabling attackers to reduce the price of shippable goods to below their legitimate value. The vulnerability exists in the 'move-to-cart' endpoint of the WishlistController and the 'checkout/cart' endpoint of the CartController, both of which accept unvalidated quantity inputs.

To address this vulnerability, Webkul Bagisto users should audit their cart and order line items for non-positive quantities or negative totals, particularly in bundle orders. Once a patch is available, this vulnerability can be mitigated by applying the update.