Pimcore vulnerabilities
We track 33 vulnerabilities in Pimcore products across 6 products. 33 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
Latest Pimcore vulnerabilities
- 8.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom R
- 8.5 High severity
Pimcore is an Open Source Data & Experience Management Platform.
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition
- 9.9 Critical severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is em
- 9.3 Critical severity
pimcore: Deserialization of Untrusted Data
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource() in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the fi
- 8.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly
- 8.8 High severity
pimcore admin-ui-classic-bundle: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause with
- 7.1 High severity
pimcore: Missing Authorization
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/R
- 8.1 High severity
pimcore: Missing Authorization
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation through /asset/webdav{path} without an authentication plugin in bundles/CoreBundle/src/Controller/WebDa
- 8.7 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through Cust
- 8.0 High severity
pimcore: Deserialization of Untrusted Data
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/To
- 7.1 High severity
pimcore: Improper Authorization
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission i
- 7.7 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key par
- 8.8 High severity
pimcore: Weak Password Recovery Mechanism for Forgotten Password
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlle
- 7.2 High severity
Pimcore CMS/DXP: Improper Neutralization of Special Elements Used in a Template Engine
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the cus
- 7.0 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. This issue affects pimcore: 12.3.3.
- 8.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.
- 7.2 High severity
customer-data-framework: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argume
- 7.5 High severity
pimcore: Allocation of Resources Without Limits or Throttling
Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are
- 9.3 Critical severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkActio
- 9.1 Critical severity
admin-ui-classic-bundle: Missing Authorization
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch
- 8.8 High severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements used in an SQL Command
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection.
- 8.8 High severity
admin-ui-classic-bundle: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid duri
- 7.2 High severity
admin-ui-classic-bundle: Use of Single-factor Authentication
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without h
- 8.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on fields of classes to be filtered for, passing input from the request, and later executes the returned
- 8.8 High severity
pimcore: Improper Limitation of a Pathname to a Restricted Directory
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive
- 7.5 High severity
pimcore: Improper Limitation of a Pathname to a Restricted Directory
Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to
- 8.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch m
- 8.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch m
- 8.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
- 8.0 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an at
- 7.8 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and no
- 9.8 Critical severity
pimcore: Improper Control of Generation of Code
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template injection, which could lead to remo
- 8.1 High severity
pimcore: Improper Neutralization of Special Elements used in an SQL Command
Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by defaul