CVE-2026-45162

HIGH

Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

Title source: cna
STIX 2.1

Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

References (4)

Core 4

Scores

CVSS v3 8.0
EPSS 0.0057
EPSS Percentile 44.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (2)
pimcore/pimcore < 11.5.17
pimcore/pimcore >= 12.0.0, < 12.3.7
Published Jul 17, 2026
Tracked Since Jul 18, 2026