CVE-2025-56426: Webkul Bagisto RCE Vulnerability

CVE-2025-56426 Overview

CVE-2025-56426 is a business logic vulnerability in WebKul Bagisto v2.3.6, an open-source Laravel-based eCommerce platform. The flaw exists in the Cart/Checkout API endpoint, where the price calculation logic fails to validate quantity inputs properly. A remote unauthenticated attacker can manipulate cart quantity parameters to alter final order pricing. The vulnerability is tracked under [CWE-77] and affects merchants running the vulnerable release in production storefronts.

Critical Impact
Attackers can manipulate cart pricing calculations through the Checkout API, enabling fraudulent purchases at attacker-controlled prices without authentication.

Affected Products

WebKul Bagisto v2.3.6
Bagisto Cart/Checkout API endpoint
Downstream deployments using the affected release

Discovery Timeline

2025-10-09 - CVE-2025-56426 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-56426

Vulnerability Analysis

The vulnerability resides in the Bagisto Cart/Checkout API, where server-side price computation trusts client-supplied quantity values without proper validation. When a user submits a request to add or update items in the cart, the backend recomputes subtotals using the submitted quantity. Because the input is not constrained to positive integers or bounded numeric ranges, an attacker can supply crafted values such as negative numbers, decimals, or specially formatted strings.

The result is a corrupted total that diverges from the product's actual list price. The order then progresses through checkout with the manipulated total, and payment gateways charge the reduced amount. This falls under business logic flaws [CWE-77] as documented by the researcher in the Medium CVE-2025-56426 Analysis.

Root Cause

The root cause is missing server-side input validation on the quantity field within the Cart/Checkout API request handler. Price recalculation logic multiplies the unit price by the client-supplied quantity without enforcing type constraints, non-negative values, or upper bounds. No canonical reference price is enforced during checkout finalization.

Attack Vector

The attack requires network access to the storefront API and no authentication. An attacker adds a legitimate item to the cart, then intercepts the checkout request and modifies the quantity parameter to a crafted value. The backend recomputes the total using the tainted input and finalizes the order at the reduced price. See the technical writeup for request-level details.

// No verified public exploit code is available.
// The vulnerability is exercised by submitting a crafted
// quantity value to the Cart/Checkout API endpoint,
// which then recomputes the order total using the tainted input.

Detection Methods for CVE-2025-56426

Indicators of Compromise

Checkout requests containing negative, zero, decimal, or non-integer quantity values in the Cart API payload.
Completed orders where the final total is inconsistent with the product's list price multiplied by a positive integer quantity.
Repeated cart update requests from the same source IP or session immediately preceding order finalization.

Detection Strategies

Log all Cart/Checkout API requests and compare submitted quantities against server-derived product prices to flag arithmetic anomalies.
Implement transaction-level reconciliation between order totals and catalog prices, alerting on any negative or below-cost orders.
Deploy a web application firewall rule that inspects JSON request bodies to the cart endpoint and rejects non-positive integer quantity fields.

Monitoring Recommendations

Monitor payment gateway records for orders processed at anomalously low amounts relative to the shopping cart contents.
Alert on abnormal ratios of cart updates to completed checkouts per session.
Review Laravel application logs for exceptions or warnings raised during price recalculation.

How to Mitigate CVE-2025-56426

Immediate Actions Required

Upgrade Bagisto to a version later than 2.3.6 once WebKul publishes a fixed release addressing the price calculation logic.
Apply server-side validation on the quantity parameter to enforce positive integers within acceptable inventory bounds.
Recompute all order totals server-side using catalog prices and reject any client-supplied price or total fields.

Patch Information

No vendor advisory URL is currently listed in the enriched data. Administrators should monitor the WebKul Bagisto repository for security releases addressing CVE-2025-56426 and review the Medium CVE-2025-56426 Analysis for reproduction details.

Workarounds

Add middleware or request validation rules that reject any Cart/Checkout request with a non-integer or non-positive quantity value.
Enforce a reconciliation step at checkout that recomputes totals from the authoritative product catalog before payment authorization.
Restrict access to the storefront API using rate limiting and geographic filters to reduce automated abuse.

bash

# Example Laravel validation rule for the cart endpoint
# app/Http/Requests/CartRequest.php
public function rules()
{
    return [
        'quantity' => 'required|integer|min:1|max:1000',
        'product_id' => 'required|integer|exists:products,id',
    ];
}