Description
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
References (3)
Core 3
Core References
Broken Link, Third Party Advisory x_refsource_misc
https://github.com/pimcore/pimcore/blob/v6.7.2/bundles/AdminBundle/Controller/Reports/CustomReportController.php%23L454
Patch, Third Party Advisory x_refsource_misc
https://github.com/pimcore/pimcore/commit/1786bdd4962ee51544fad537352c2b4223309442
Exploit, Patch, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1070132
Scores
CVSS v3
7.1
EPSS
0.0132
EPSS Percentile
67.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Details
CWE
CWE-22
Status
published
Products (2)
pimcore/pimcore
< 6.8.8
pimcore/pimcore
0 - 6.8.8Packagist
Published
Feb 18, 2021
Tracked Since
Feb 18, 2026