CVE-2026-45162

HIGH 8.0

Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

CVSS Score

8.0

EPSS Score

0.0%

EPSS Percentile

0th

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

CWE	CWE-502
Vendor	pimcore
Product	pimcore
Published	Jul 17, 2026

Stay Ahead of the Next One

Get instant alerts for pimcore pimcore

Be the first to know when new high vulnerabilities affecting pimcore pimcore are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

pimcore / pimcore

< 11.5.17 >= 12.0.0, < 12.3.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pimcore/pimcore/security/advisories/GHSA-36fc-7wjg-mfvj github.com: https://github.com/pimcore/pimcore/pull/19119 github.com: https://github.com/pimcore/pimcore/commit/4788bf3a3a7f2f760a8fe61e522565941e154e1e github.com: https://github.com/pimcore/pimcore/releases/tag/v12.3.7