CVE-2026-5362
CVE-2026-5362 · Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.
CVSS 4.8 · Medium · EPSS 0.3%
- Published
- Updated
Stack: php
Affected products and versions
pimcore
- Versions
- v12.3.3: Affected
No fix published
pimcore/pimcore Packagist
- Versions
- 12.3.3
No fix published