[HIGH] Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

PKSA-td46-kz3d-nfhj CVE-2026-21448 GHSA-5j4h-4f72-qpm6

Affected package: bagisto/bagisto

Affected version: <2.3.10

Reported by:
GitHub