pimcore vulnerabilities

Products

• pimcore/pimcore 152
• pimcore/pimcore 75
• pimcore/admin-ui-classic-bundle 17
• admin classic bundle 14
• customer management framework 9
• pimcore/customer-management-framework-bundle 9
• pimcore/customer-data-framework 7
• pimcore/customer-data-framework 5
• pimcore/studio-backend-bundle 3
• core 1
• e-commerce framework 1
• perspective editor 1
• pimcore admin-ui-classic-bundle 1
• Pimcore AdminBundle 1
• Pimcore Customer Data Framework 1
• pimcore/admin-ui-classic-bundle 1
• pimcore/data-hub 1
• pimcore/data-hub 1
• pimcore/data-importer 1
• pimcore/demo 1
• pimcore/demo 1
• pimcore/ecommerce-framework-bundle 1
• pimcore/perspective-editor 1
• pimcore/web2print-tools-bundle 1
• web2print tools 1

Latest pimcore CVEs

Newest publication first · page 1 of 8

1. CVE-2026-109392 Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview

   Published 2026-10-12

   Medium·CVSS 5.1 EPSS 0.17%

   Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute...

2. CVE-2026-55416 Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

   Published 2026-09-14

   High·CVSS 8.8 EPSS 0.65%

   Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration...

3. CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

   Published 2026-09-14

   High·CVSS 8.5 EPSS 0.41%

   Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only t...

4. CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

   Published 2026-08-28

   Critical·CVSS 9.9 EPSS 0.65%

   Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an ide...

5. CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column

   Published 2026-08-28

   Critical·CVSS 9.3 EPSS 0.68%

   Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource() in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field __hotspots objec...

6. CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

   Published 2026-08-12

   High·CVSS 8.8 EPSS 0.50%

   Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIX_TIMESTAMP...

7. CVE-2026-72562 Pimcore pimcore admin-ui-classic-bundle - SQL Injection

   Published 2026-08-11

   High·CVSS 8.8 EPSS 0.43%

   An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization...

8. CVE-2026-45704 Pimcore: CustomReports Share Bypass

   Published 2026-07-17

   High·CVSS 7.1 EPSS 0.43%

   Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportC...

9. CVE-2026-44739 Pimcore: SQL Injection in Custom Reports Column Configuration

   Published 2026-07-17

   High·CVSS 8.7 EPSS 0.39%

   Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:c...

10. CVE-2026-45260 Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

    Published 2026-07-17

    High·CVSS 8.1 EPSS 0.64%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDavController.php, and...

11. CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export

    Published 2026-07-17

    Medium·CVSS 6.4 EPSS 0.32%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the word_export feature permission and directly resolves attacker-contro...

12. CVE-2026-45162 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

    Published 2026-07-17

    High·CVSS 8.0 EPSS 0.99%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.ph...

13. CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

    Published 2026-07-09

    High·CVSS 8.8 EPSS 0.67%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl....

14. CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

    Published 2026-07-09

    High·CVSS 7.7 EPSS 0.41%

    Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pi...

15. CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

    Published 2026-07-09

    High·CVSS 7.1 EPSS 0.35%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classe...

16. CVE-2026-11407 Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

    Published 2026-06-17

    High·CVSS 8.6 EPSS 0.62%

    Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPol...

17. CVE-2026-5362 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering

    Published 2026-04-27

    Medium·CVSS 4.8 EPSS 0.19%

    An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.

18. CVE-2026-5394 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling

    Published 2026-04-27

    High·CVSS 7.0 EPSS 0.43%

    An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. This issue affects pimcore: 12.3.3.

19. CVE-2026-27461 Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause

    Published 2026-02-24

    Medium·CVSS 6.9 EPSS 0.51%

    Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitizati...

20. CVE-2026-23496 Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization

    Published 2026-01-15

    Medium·CVSS 5.4 EPSS 0.29%

    Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing reve...

21. CVE-2026-23494 Pimcore is Missing Function Level Authorization on "Static Routes" Listing

    Published 2026-01-15

    Medium·CVSS 6.5 EPSS 0.35%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL pa...

22. CVE-2026-23495 Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

    Published 2026-01-15

    Medium·CVSS 4.3 EPSS 0.36%

    Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e....

23. CVE-2026-23493 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

    Published 2026-01-15

    Medium·CVSS 4.9 EPSS 0.43%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed o...

24. CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

    Published 2026-01-14

    Medium·CVSS 4.9 EPSS 0.47%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injectio...

25. CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

    Published 2025-04-08

    Low·CVSS 1.8 EPSS 0.26%

    Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the altera...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.