Skip to content
OpenAdvisories

Package · Packagist

pimcore/pimcore

135 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-55634

    Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is e…

    pimcore pimcore pimcore/pimcore Packagist
  • Critical 9.3
    CVE-2026-55220

    Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource() in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the f…

    pimcore pimcore pimcore/pimcore Packagist
  • Critical 9.8
    CVE-2022-39365

    RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

    Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template injection, which could lead to rem…

    pimcore pimcore pimcore/pimcore Packagist
  • Critical 9.8
    CVE-2019-18981

    Pimcore Access Control Issues

    Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.

    pimcore/pimcore Packagist
  • Critical 9.8
    CVE-2019-18985

    Pimcore 2FA Vulnerable to Brute Forcing

    Pimcore before 6.2.2 lacks brute force protection for the 2FA token.

    pimcore/pimcore Packagist