bagisto/bagisto
Open Source eCommerce Platform Built with Laravel for Enterprise-Scale Commerce Supporting 10M+ SKUs
How bagisto is put together
Bagisto is an open-source Laravel eCommerce framework (PHP backend with Blade templates) whose storefront and admin UIs are progressively enhanced with Vue.js 3 components built through Vite. The codebase is organized as modular Laravel packages under packages/Webkul/* (Admin, Shop, Installer, etc.), each shipping its own composer.json, package.json, Vite and Tailwind configs, following the Concord package pattern referenced by config/concord.php. HTTP entry is public/index.php with routing defined in routes/web.php and application bootstrapping in bootstrap/app.php. Persistence flows through Laravel Eloquent with dated migrations (users, sessions, jobs/queues, personal access tokens), and optional Elasticsearch integration is configured via config/elasticsearch.php.
Languages
Frameworks
Datastores
Infrastructure
Major components
packages/Webkul/Admin
Admin panel package with its own Vue/Tailwind frontend assets, Vite build pipeline, charting entry point, and Playwright tests.
packages/Webkul/Shop
Customer-facing storefront package with its own Vue/Tailwind assets and independent Vite build configuration.
packages/Webkul/Installer
Web-based installation wizard package with its own asset build pipeline for initial setup of the store.
app/Http
Base controllers and HTTP middleware such as EncryptCookies for the application layer.
routes/
Route definitions (web.php, console.php, breadcrumbs.php) mapping HTTP requests into the package controllers.
database/migrations and seeders
Schema definitions for users, password resets, sessions, queue infrastructure, personal access tokens, and agent conversations, plus database seeding.
config/
Laravel and ecosystem configuration including auth, sanctum, cors, database, elasticsearch, openai/ai, purify, session, and themes.
docker/production
Production deployment images for Apache, LiteSpeed, and Nginx with shared PHP ini, entrypoint, and build-install scripts.
A quiet stabilization week focused on fixing flaky tests and repairing the build pipeline.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet stabilization week focused on fixing flaky tests and repairing the build pipeline.
Week of 2026-08-17
A high-volume week centered on a major themes revamp (drafts, previews, and a 'My Themes / Buy Themes' split) plus security fixes, MariaDB support in the installer, and a batch of customer-reported bugs.
Week of 2026-08-10
Nineteen fixes landed this week, including repairs to menus, product listings, payment gateways, and a memory leak, plus centralized locale/currency management.
Week of 2026-08-03
A large release-prep week: version bump and changelog, security updates, a critical fix sanitizing product descriptions in structured search output, and lots of code cleanup.
Week of 2026-07-27
This week added search to key admin lists and sample-data tools for testing, fixed UI issues across the storefront, and merged several security-driven library updates.
Over the past month the team shipped a steady stream of bug fixes across the storefront and admin panel while building out major new capabilities: a revamped themes system with draft/preview support, a new MariaDB installer option, Docker Hub database variants, Brevo email API support, and full-page caching. Several customer-reported issues were resolved (broken product pages from invalid input, data loss when deleting templates or attribute families), alongside security patches, dependency upgrades, and a wave of automated browser tests to keep things stable.
Week by week
2026-08-24A quiet stabilization week focused on fixing flaky tests and repairing the build pipeline.latest3 changes
Chore
Flaky test fixed
An unreliable automated test was made consistent so it no longer fails randomly.
Fix
Pipeline repaired
The automated build-and-check process that runs on every code change is working again.
Chore
Test fixes and new installation test
Existing tests were corrected and a brand-new test was added covering the software installation flow.
2026-08-17A high-volume week centered on a major themes revamp (drafts, previews, and a 'My Themes / Buy Themes' split) plus security fixes, MariaDB support in the installer, and a batch of customer-reported bugs.6 changes
Feature
Themes overhaul with drafts and previews
Store owners can now save theme changes as drafts, preview them safely, and choose between their own themes and purchasable ones, with automatic cleanup of discarded drafts.
Feature
MariaDB option in installer
New installations can now choose MariaDB as their database, and a new database variant was also added to the official Docker images.
Feature
Full-page caching and Brevo email API
Full-page caching configuration was added with related fixes, and support for the Brevo email service API was integrated.
Fix
Security patches
Multiple security vulnerabilities were fixed across the platform, along with sanitization of user-entered content.
Fix
Customer-reported bugs fixed
Issues like non-numeric page sizes breaking product listings, deleting used templates breaking campaigns, invalid regex blanking product screens, and copying products losing their special settings were all resolved.
Chore
Automated browser tests added
Playwright end-to-end tests were added and updated, including improved handling of the mini cart's visibility.
2026-08-10Nineteen fixes landed this week, including repairs to menus, product listings, payment gateways, and a memory leak, plus centralized locale/currency management.6 changes
Fix
Product listing image fix
Product listing pages now show the correct base image instead of a wrong or missing one.
Fix
Payment gateway repairs
PayU, Razorpay, and other payment gateways were fixed to use fresh cart data after totals are recalculated, preventing stale checkout information.
Refactor
Memory leak fixed
A memory leak that could degrade performance over time was identified and eliminated.
Fix
Import progress visibility
Data import error messages were fixed and a view button added so admins can check import progress.
Feature
Centralized locales and currencies
Language and currency settings were consolidated into one place for easier management.
Fix
Datagrid improvements
Product tables got fixes for searching, sorting, and edge-case display problems.
2026-08-03A large release-prep week: version bump and changelog, security updates, a critical fix sanitizing product descriptions in structured search output, and lots of code cleanup.6 changes
Fix
JSON-LD security fix
Product descriptions shown in structured data for search engines are now cleaned of unsafe content.
Chore
Version bump and changelog
The changelog and version number were updated ahead of a release.
Fix
Installer and seeder fixes
Problems with running the setup wizard and loading initial demo data were corrected.
Refactor
Code split into smaller files
One large file was broken into smaller, easier-to-maintain pieces.
Fix
Third-level admin menu fixed
Menus nested three levels deep in the admin area now work correctly.
Chore
Dependency upgrades and docs cleanup
Key libraries (Guzzle, CommonMark) were upgraded, and mismatched code documentation comments were fixed.
2026-07-27This week added search to key admin lists and sample-data tools for testing, fixed UI issues across the storefront, and merged several security-driven library updates.6 changes
Feature
Search added to customer grid and product list
Admins can now search directly within the customer table and the product list page instead of scrolling.
Feature
Sample data generators
Utilities were added to generate sample products, customers, and tax rates in CSV form for testing and demos.
Fix
Storefront UI polish
Product detail pages, subcategory layouts, spacing, and a homepage layout issue caused by webmcp were all fixed.
Refactor
Enhanced datagrids and Elasticsearch
Admin data tables were improved overall and Elasticsearch-related problems were addressed.
Chore
Library security updates
PDF generation, spreadsheet handling, and HTTP libraries were updated to patched versions via automated dependency PRs.
Fix
Cart logic tweak
Cart calculation behavior was refined based on a community contribution.
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (14 advisories) across 4 scanned dependencies.
axios 1.7.9
13 advisories. Fixed in 1.16.0.
How it can be abusedAn attacker who can feed crafted data into the shop's JavaScript could abuse flaws in this HTTP library to hijack requests, inject headers, or steal session tokens and credentials sent from the storefront or admin panel. Any visitor using Bagisto's Vue-based shop or admin interface would be affected.
- highGHSA-35jp-ww65-95whaxios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- highGHSA-3g43-6gmg-66jwaxios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- highGHSA-43fc-jf86-j433Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
- highGHSA-4hjh-wcwx-xvwjAxios is vulnerable to DoS attack through lack of data size check
- highGHSA-6chq-wfr3-2hj9Axios: Header Injection via Prototype Pollution
- highGHSA-777c-7fjr-54vfAllocation of Resources Without Limits or Throttling in Axios
- highGHSA-hfxv-24rg-xrqfAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
- highGHSA-j5f8-grm9-p9fcAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
- highGHSA-jr5f-v2jv-69x6axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
- highGHSA-p92q-9vqr-4j8vAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- highGHSA-pf86-5x62-jrwfAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
- highGHSA-pmwg-cvhr-8vh7Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
- highGHSA-q8qp-cvcw-x6jjAxios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
vite 6.4.2
1 advisory. Fixed in 8.0.16.
How it can be abusedThis flaw only matters when a developer runs the Vite dev server on a Windows machine. An attacker who can reach that dev server over the network could use alternate Windows file path tricks to read source files outside the allowed folder, potentially exposing code or secrets like local environment values. Shoppers and live Bagisto storefronts are not affected since production sites serve prebuilt files.
- highGHSA-fx2h-pf6j-xcffvite: `server.fs.deny` bypass on Windows alternate paths
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required