Back to overview

CVE-2026-45162

HIGH Exploitation: PoC
8.0
CVSS 3.1
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

Metadata

CVE ID
CVE-2026-45162
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-08 20:44 UTC
Published
2026-07-17 18:50 UTC
Last updated
2026-07-17 23:15 UTC
Primary CWE
CWE-502
CWE-502: Deserialization of Untrusted Data
Vendor / Product
pimcore / pimcore
Sources
cve.org  ·  NVD

Severity & Metrics

8.0 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
pimcore pimcore — < 11.5.17, >= 12.0.0, < 12.3.7
Weakness (CWE)
CWESourceDescription
CWE-502 cna CWE-502: Deserialization of Untrusted Data
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.0 HIGH 3.1 cna CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References (4)
Back to overview