Bagisto versions below 2.3.10 are vulnerable to Server‑Side Template Injection through the 'type' query parameter. An attacker who can supply a crafted value can cause the application to render arbitrary template code, which may lead to remote code execution or similar high‑impact consequences. The weakness is classified as View Layer Template Injection (CWE‑1336).

The affected product is the Bagisto e‑commerce platform. All releases from the initial launch up through version 2.3.9 are impacted. The vulnerable code resides in the core application layer, and the issue was fixed in Bagisto 2.3.10.

The CVSS base score is 7.3, indicating a high severity. The EPSS score is less than 1 percent, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack path requires an attacker to send a malicious request to the web application, most likely via HTTP. Successful exploitation also depends on the ability to inject and execute template code.