{"kind": "product", "path": "vulns/packagist/pimcore%2Fpimcore", "name": "pimcore/pimcore", "product": "pimcore/pimcore", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-55416", "noindex": false, "published": "2026-09-14T16:52:28.185Z", "modified": "2026-09-14T20:06:39.915Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0065, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-55416", "title": "Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a L", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-23rh-xw42-fq82", "https://github.com/pimcore/pimcore/pull/19175", "https://github.com/pimcore/pimcore/commit/1999fee27ed0d027ad5b8195ecf6e27243729530"], "fixes": ["11.5.19", "12.3.10", "2026.1.6"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-55072", "noindex": false, "published": "2026-09-14T16:50:27.483Z", "modified": "2026-09-14T17:17:58.863Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00409, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-55072", "title": "Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php incorporates the stored class ID into an unquoted object table identifier, allowing the UID to supply SQL syntax. The resulting query can read or modify arbitrary Pimcore database tables, including disclosure ", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428", "https://github.com/pimcore/pimcore/pull/19177", "https://github.com/pimcore/pimcore/commit/33a0e1887e1e31b4283b016ac5440c35ea5697b4"], "fixes": ["12.3.9", "2026.1.5"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-55634", "noindex": false, "published": "2026-08-28T19:16:20.078Z", "modified": "2026-08-28T20:06:15.024Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.0065, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-55634", "title": "Pimcore: Remote Code Execution via DataObject Class-Definition Field Name", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and by models/DataObject/ClassDefinition/Helper/Dao.php into ALTER TABLE identifiers. An authenticated user with the objects permission can inject PHP syntax into the generated DataObject class, causing attacker-controlled code in generated var/classes/D", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-9x44-4gxf-8c25", "https://github.com/pimcore/pimcore/pull/19183", "https://github.com/pimcore/pimcore/commit/a4f8c3cfee58b7d5fe4873d67782eff58dae9b9d"], "fixes": ["12.3.10", "2026.1.6"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-55220", "noindex": false, "published": "2026-08-28T19:12:43.739Z", "modified": "2026-08-31T18:53:58.013Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.0068, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-55220", "title": "Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\\Model\\DataObject\\ClassDefinition\\Data\\Hotspotimage::getDataFromResource() in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field __hotspots object-store column to Pimcore\\Tool\\Serialize::unserialize() without an allowed-classes restriction after JSON decoding fails. An attacker with a separate capability to write crafted PHP serialized bytes into that column can instantiate available classes and trigger magic methods when an affected DataObject is loaded, which can produce arbitrary file writes or code executi", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-w23p-wrp7-ch38", "https://github.com/pimcore/pimcore/pull/19181", "https://github.com/pimcore/pimcore/commit/b184c01bf11e213e601d965b4e96c8bb7248e980"], "fixes": ["12.3.10", "2026.1.6"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45704", "noindex": false, "published": "2026-07-17T19:12:50.888Z", "modified": "2026-07-20T13:53:55.744Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45704", "title": "Pimcore: CustomReports Share Bypass", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php, allowing a low-privileged backend user with the reports permission to directly request an unshared report such as poc-secret-report by name and read report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings even when ", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-jwcc-gv4m-93x6", "https://github.com/pimcore/pimcore/pull/19099", "https://github.com/pimcore/pimcore/commit/1893ff1cd116e442b995ddf17e8c6e0aa372268e"], "fixes": ["11.5.17", "12.3.6", "2026.1.2"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44739", "noindex": false, "published": "2026-07-17T19:10:10.107Z", "modified": "2026-07-17T23:15:23.395Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00392, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44739", "title": "Pimcore: SQL Injection in Custom Reports Column Configuration", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-3234-gxc3-pq6f", "https://github.com/pimcore/pimcore/pull/19098", "https://github.com/pimcore/pimcore/commit/3fd7733464f464e58ffa49ed91550c1a3f9535f2"], "fixes": ["11.5.17", "12.3.6", "2026.1.2"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45260", "noindex": false, "published": "2026-07-17T19:08:38.869Z", "modified": "2026-07-21T02:01:19.740Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.00636, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45260", "title": "Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and models/Asset/WebDAV/Tree.php performs asset mutation and deletion through models/Asset.php before checking a current Pimcore user or the rename, delete, create, or publish permissions, allowing unauthorized asset deletion, moves, or overwrites. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-wc7j-g8wx-m2qx", "https://github.com/pimcore/pimcore/pull/19120", "https://github.com/pimcore/pimcore/commit/9d7c77fd9b19fa011ce470de95d4438e65007d99"], "fixes": ["11.5.17", "12.3.7", "2026.1.3"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45703", "noindex": false, "published": "2026-07-17T18:52:44.530Z", "modified": "2026-07-17T19:22:48.025Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L", "severity": "medium", "epss": 0.00317, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45703", "title": "Pimcore: WordExport Authorization Bypass for Unauthorized Document Export", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-332x-r494-54fq", "https://github.com/pimcore/pimcore/releases/tag/v12.3.7", "https://nvd.nist.gov/vuln/detail/CVE-2026-45703"], "fixes": ["11.5.17", "12.3.7", "2026.1.3"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45162", "noindex": false, "published": "2026-07-17T18:50:19.924Z", "modified": "2026-07-17T23:15:31.060Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00987, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45162", "title": "Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-36fc-7wjg-mfvj", "https://github.com/pimcore/pimcore/pull/19119", "https://github.com/pimcore/pimcore/commit/4788bf3a3a7f2f760a8fe61e522565941e154e1e"], "fixes": ["11.5.17", "12.3.7", "2026.1.3"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-11407", "noindex": false, "published": "2026-06-17T20:07:50.407Z", "modified": "2026-10-08T15:22:14.172Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00623, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-11407", "title": "Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed", "description": "Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPolicy. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\\Text component to perform arbitrary file reads, execute arbitrary database queries, and potentially achieve remote code execution via PHP object gadget chains, with the pimcore_* function wildcard further broadening the bypass to all Pimcore Twig functions.", "references": ["https://github.com/pimcore/pimcore/pull/19193", "https://github.com/pimcore/pimcore/commit/fffa7f6396329e88610db70a8652529bbc734892", "https://www.vulncheck.com/advisories/pimcore-cms-twig-sandbox-bypass-via-securitypolicy-checkmethodallowed"], "fixes": [], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-5362", "noindex": false, "published": "2026-04-27T20:16:01.154Z", "modified": "2026-04-28T14:36:06.112Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00194, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-5362", "title": "Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering", "description": "An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered.\n\nThis issue affects pimcore: v12.3.3.", "references": ["https://fluidattacks.com/es/advisories/mago", "https://github.com/pimcore/pimcore/", "https://nvd.nist.gov/vuln/detail/CVE-2026-5362"], "fixes": [], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-5394", "noindex": false, "published": "2026-04-27T19:15:04.496Z", "modified": "2026-05-05T17:17:45.826Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00434, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-5394", "title": "Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling", "description": "An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.\n\nThis issue affects pimcore: 12.3.3.", "references": ["https://fluidattacks.com/es/advisories/dragons", "https://github.com/pimcore/pimcore", "https://github.com/pimcore/pimcore/pull/19108"], "fixes": ["11.5.17", "12.3.7", "2026.1.3"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-27461", "noindex": false, "published": "2026-02-24T02:50:48.287Z", "modified": "2026-02-24T18:58:07.625Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00509, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-27461", "title": "Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause", "description": "Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp", "https://github.com/pimcore/pimcore/pull/18991", "https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4"], "fixes": ["12.3.3"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-23494", "noindex": false, "published": "2026-01-15T16:52:58.729Z", "modified": "2026-01-15T18:08:13.110Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00346, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-23494", "title": "Pimcore is Missing Function Level Authorization on \"Static Routes\" Listing", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL patterns defined via the backend interface or the var/config/staticroutes.php file, including details like regex-based patterns, controllers, variables, and priorities. These routes are registered automatically through the PimcoreStaticRoutesBundle and integrated into the MVC routing system. Testing revealed that an authenticated backend user lacking explicit permission", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf", "https://github.com/pimcore/pimcore/pull/18893", "https://github.com/pimcore/pimcore/releases/tag/v11.5.14"], "fixes": ["11.5.14", "12.3.1"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-23493", "noindex": false, "published": "2026-01-15T16:38:23.923Z", "modified": "2026-01-15T19:02:08.517Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "severity": "high", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-23493", "title": "Pimcore ENV Variables and Cookie Informations are exposed in http_error_log", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h", "https://github.com/pimcore/pimcore/pull/18918", "https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601"], "fixes": ["11.5.14", "12.3.1"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-23492", "noindex": false, "published": "2026-01-14T18:21:55.237Z", "modified": "2026-01-14T21:14:46.329Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00466, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-23492", "title": "Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848", "description": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure. This vulnerability is fixed in 12.3.1 and 11.5.14.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-qvr7-7g55-69xj", "https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3", "https://nvd.nist.gov/vuln/detail/CVE-2026-23492"], "fixes": ["11.5.14", "12.3.1"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-27617", "noindex": false, "published": "2025-03-11T15:35:51.895Z", "modified": "2025-03-12T15:29:48.550Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00498, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-27617", "title": "Pimcore Vulnerable to SQL Injection in getRelationFilterCondition", "description": "Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-qjpx-5m2p-5pgh", "https://github.com/pimcore/pimcore/commit/19a8520895484e68fd254773e32476565d91deea", "https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47"], "fixes": ["11.5.4"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-11954", "noindex": false, "published": "2025-01-28T13:14:42.976Z", "modified": "2025-01-28T14:17:00.797Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.01089, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-11954", "title": "Pimcore Search Document cross site scripting", "description": "A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", "references": ["https://vuldb.com/?id.293905", "https://vuldb.com/?ctiid.293905", "https://vuldb.com/?submit.451774"], "fixes": ["11.5.3"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-2332", "noindex": false, "published": "2024-11-15T10:57:19.795Z", "modified": "2024-11-15T21:00:49.061Z", "cvss": 4, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.0037, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-2332", "title": "Stored Cross-site Scripting (XSS) in pimcore/pimcore", "description": "A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.", "references": ["https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c", "https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe", "https://nvd.nist.gov/vuln/detail/CVE-2023-2332"], "fixes": ["10.5.21"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}, {"id": "GHSA-hq76-662x-7mw4", "noindex": false, "published": "2024-09-03T19:45:26Z", "modified": "2024-12-05T05:28:51.120085Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-hq76-662x-7mw4", "title": "Pimcore includes vulnerable PHPOffice/PhpSpreadsheet", "description": "### Summary\nPimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: [GHSA-ghg6-32f9-2jp7](https://github.com/advisories/GHSA-ghg6-32f9-2jp7).\n\n", "references": ["https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4", "https://github.com/advisories/GHSA-ghg6-32f9-2jp7", "https://github.com/pimcore/pimcore"], "fixes": ["10.6.9.12", "11.1.6.11"], "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}, {"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}]}], "total": 135, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 7, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "pimcore/pimcore", "path": "vulns/packagist/pimcore%2Fpimcore", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["2026.1.5", "2026.1.3", "2026.1.2", "12.3.9", "12.3.7", "12.3.6", "12.3.3", "12.3.1", "11.5.19", "11.5.17", "11.5.14", "11.5.4"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:22:14.172Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}