Bagisto allows injection of template expressions through the first and last name fields supplied by low‑privilege users. The likely attack vector is a low‑privilege user creating or editing a customer profile to supply malicious payloads in the name fields. Based on the description, it is inferred that the unsanitized input is rendered by the server, enabling an attacker to execute arbitrary code within the application context. The vulnerability is classified as CWE‑1336, server‑side template injection, which can compromise confidentiality, integrity, and availability of the platform.

The affected product is the Bagisto eCommerce platform. All releases prior to version 2.3.10 are impacted; version 2.3.10 and later contain the fix.

The CVSS score of 7.4 indicates a high severity. EPSS is listed as less than 1%, suggesting a low current exploitation probability. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the flaw by creating or editing a customer profile, supplying malicious payloads in the name fields, and the server will evaluate them during template rendering.