Pimcore vulnerabilities

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata, leading to unintended SQL execution in the backend.

Pimcore is an open source data and experience management platform. Prior to versions 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure. This vulnerability is fixed in 12.3.1 and 11.5.14.

SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.

Pimcore prior to versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in the class-definition import endpoint where a DataObject field name is emitted without an identifier allowlist, allowing an authenticated user with objects permission to inject PHP syntax into generated DataObject classes and inject SQL identifier content into schema-changing statements. The setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters.

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in Hotspotimage::getDataFromResource() that passes the __hotspots column to Pimcore\Tool\Serialize::unserialize() without an allowed-classes restriction after JSON decoding fails. An attacker with the ability to write crafted PHP serialized bytes into that column can instantiate available classes and trigger magic methods, potentially leading to arbitrary file writes or code execution. This issue is fixed for Hotspotimage in versions 11.5.19, 12.3.10, and 2026.1.6.

Pimcore before versions 11.5.17 (LTS) and 12.3.6 has inconsistent authorization between the report listing and report detail endpoints in CustomReports. A low-privileged backend user with the 'reports' permission can read an unshared report by name, accessing metadata, data source configuration, and sharing settings.

Vulnerability in Pimcore before versions 11.5.17 (LTS) and 12.3.7. The WebDAV endpoint `/asset/webdav{path}` allows MOVE operation without authentication, enabling an unauthorized attacker to delete, move, or overwrite assets.

Pimcore prior to versions 11.5.17 (LTS) and 12.3.6 contains an SQL injection vulnerability in the columnConfigAction endpoint. An attacker with reports_config permission can execute arbitrary SELECT queries, use UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate data.

Pimcore prior to versions 11.5.17 (LTS) and 12.3.7 has a vulnerability in the WordExport export flow. It only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view.

Pimcore before versions 11.5.17 (LTS) and 12.3.7 calls PHP unserialize() on data from database columns and files without the allowed_classes restriction in multiple locations, including lib/Tool/Authentication.php. This enables object injection and remote code execution if an attacker can control the serialized data source.

In Pimcore before versions 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint was guarded by the 'objects' permission instead of 'classes', allowing editor-level users to create class definitions without admin privileges. Missing UID format validation in the API layer allowed malformed UIDs to reach model-layer validation and expose internal exceptions.

In Pimcore before versions 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used to authenticate with full admin privileges while bypassing two-factor authentication.

Pimcore has a path traversal vulnerability in the `AssetController::importServerFilesAction`, allowing an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.