SB20260917214 - Multiple vulnerabilities in Pimcore

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260917214

SB20260917214 - Multiple vulnerabilities in Pimcore

Published: September 17, 2026

Security Bulletin ID SB20260917214
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-55220)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to unrestricted deserialization of untrusted data in the Hotspotimage getDataFromResource() method and sibling ImageGallery, Block, and Video marshallers when loading a DataObject after crafted serialized data is written to an object-store column. A local user can write crafted serialized data to an affected object-store column to execute arbitrary code.

The affected load path requires a DataObject with one of the affected field types and a non-null associated image value.


2) Code Injection (CVE-ID: CVE-2026-55634)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the DataObject class-definition field-name handling when importing a class definition containing a crafted field name. A remote user can import a crafted class definition to execute arbitrary code.

Execution occurs when an object of the affected class is loaded.


3) SQL injection (CVE-ID: CVE-2026-55416)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read, modify, or delete database data.

The vulnerability exists due to improper neutralization of special elements in an SQL command in the Custom Reports bundle Sql adapter\'s buildQueryString() method when processing report configuration fields. A remote user can submit a malicious report configuration to read, modify, or delete database data.

Exploitation requires the reports_config permission.


Remediation

Install update from vendor's website.

References