Please do not report security vulnerabilities here.
Use our central security reporting process: Platform Version Vulnerabilities
Security: pimcore/pimcore
Security
SECURITY.md
-
Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege EscalationGHSA-f97c-ph8j-8vff published
Jun 29, 2026 by martineiberHigh -
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)GHSA-w23p-wrp7-ch38 published
Jul 30, 2026 by astapcHigh -
# SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashesGHSA-79cw-hfcc-7mw9 published
Jun 29, 2026 by martineiberHigh -
Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypassGHSA-h854-c3m3-mh5v published
Jun 29, 2026 by martineiberHigh -
Remote Code Execution via DataObject Class-Definition Field Name in Pimcore 12.xGHSA-9x44-4gxf-8c25 published
Jul 30, 2026 by astapcCritical -
ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table nameGHSA-2mhj-fhvg-v428 published
Jun 10, 2026 by kingjia90High -
Missing Authorization in WebDAV MOVE via unchecked asset move handlingGHSA-wc7j-g8wx-m2qx published
May 26, 2026 by kingjia90High -
Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling during class definition import/saveGHSA-r2f4-ff2p-xc64 published
May 26, 2026 by kingjia90High -
SQL Injection in Custom Reports Column ConfigurationGHSA-3234-gxc3-pq6f published
May 26, 2026 by kingjia90High -
Unsafe PHP Deserialization in Multiple Locations Without allowed_classes RestrictionGHSA-36fc-7wjg-mfvj published
May 26, 2026 by kingjia90High
Learn more about advisories related to pimcore/pimcore in the GitHub Advisory Database