CVE-2026-6744

CVE-2026-6744 is a server-side request forgery (SSRF) vulnerability affecting Bagisto e-commerce platform versions up to 2.3.15, specifically in the Downloadable Link Handler component's copy function. This flaw allows authenticated attackers to trigger malicious server-side requests, potentially compromising internal systems and data. The vulnerability carries a CVSS score of 6.3 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials. Exploitation results in limited confidentiality, integrity, and availability impacts. The EPSS score of 0.00034 indicates minimal prevalence of active exploitation relative to the CVE ecosystem, though the flaw is listed on the active Hot List. Public exploit code is available, and the vulnerability has attracted community attention. However, there is currently no indication of active real-world exploitation. The vendor has acknowledged the issue through GitHub advisories and committed to addressing it in upcoming releases, though patches may not yet be fully deployed across all installations.