CVE-2025-40675: Webkul Bagisto XSS Vulnerability

CVE-2025-40675 Overview

CVE-2025-40675 is a Reflected Cross-Site Scripting (XSS) vulnerability in Webkul Bagisto v2.0.0, an open-source Laravel-based eCommerce platform. The flaw exists in the query parameter of the /search endpoint, which fails to sanitize user-controlled input before reflecting it into the rendered HTML response. Attackers can craft malicious URLs containing JavaScript payloads and deliver them to victims through phishing or social engineering. When a victim clicks the link, the injected script executes in their browser under the origin of the vulnerable Bagisto site. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session cookie theft, account takeover, and arbitrary actions performed in the victim's authenticated context on the Bagisto storefront.

Affected Products

Webkul Bagisto v2.0.0
Bagisto storefront /search endpoint
Deployments exposing the query GET parameter to untrusted users

Discovery Timeline

2025-06-09 - CVE-2025-40675 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40675

Vulnerability Analysis

The vulnerability resides in the search functionality of Bagisto v2.0.0. The application accepts user input through the query GET parameter on the /search route and reflects that value directly into the HTML response without applying proper output encoding or input sanitization. This behavior matches the classic reflected XSS pattern classified under CWE-79.

Because the injected content is rendered in the same origin as the Bagisto storefront, malicious JavaScript executes with full access to the DOM, session cookies not protected by HttpOnly, and any client-side state. Attackers can exfiltrate authentication tokens, submit forms on behalf of the victim, or pivot to further attacks such as credential harvesting through injected fake login prompts.

Root Cause

The root cause is missing or insufficient output encoding when the query parameter is echoed into the search results page. Laravel Blade templates encode variables by default when using {{ $var }} syntax, so the vulnerability likely stems from unescaped rendering (for example, using {!! $var !!}) or from concatenating the parameter into JavaScript contexts where HTML-entity encoding alone is insufficient.

Attack Vector

Exploitation requires the victim to click a crafted URL, which aligns with the User Interaction requirement in the CVSS vector. A typical attack chain involves the attacker delivering a link such as https://<bagisto-site>/search?query=<payload> via email, chat, or a malicious referrer. When rendered, the payload executes JavaScript in the victim's browser session. See the INCIBE Security Notice on XSS for additional technical context.

Detection Methods for CVE-2025-40675

Indicators of Compromise

HTTP GET requests to /search containing <script>, onerror=, javascript:, or URL-encoded equivalents (%3Cscript%3E) in the query parameter
Web server access logs showing unusually long or encoded query values from external referrers
Outbound requests from client browsers to attacker-controlled domains shortly after visits to /search URLs

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects the query parameter on /search for common XSS payload signatures
Enable Content Security Policy (CSP) violation reporting to capture inline-script execution attempts
Review Bagisto access logs for reflected payloads and cross-reference with user-agent and referrer anomalies

Monitoring Recommendations

Alert on HTTP 200 responses to /search requests containing script-related tokens in query strings
Monitor authenticated user sessions for cookie access from unexpected client-side script origins
Track referrer chains that lead users from external domains directly to /search with populated query parameters

How to Mitigate CVE-2025-40675

Immediate Actions Required

Restrict or filter the query parameter on the /search endpoint at the WAF or reverse proxy layer until a patch is applied
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Rotate session secrets and force re-authentication if evidence of exploitation is identified

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Administrators should monitor the Webkul Bagisto GitHub repository for releases newer than v2.0.0 and apply upgrades that address the search input handling. Consult the INCIBE Security Notice on XSS for coordinated remediation guidance.

Workarounds

Apply server-side input validation to reject non-alphanumeric characters in the query parameter where business logic allows
Ensure Blade templates use the default {{ }} escaped output syntax when rendering the search term
Set HttpOnly and Secure flags on session cookies to reduce the impact of stolen cookies via document.cookie

bash

# Example NGINX rule to block obvious XSS payloads in the query parameter
if ($args ~* "query=.*(<|%3C)(script|img|svg|iframe)") {
    return 403;
}