Deserialization of Untrusted Data in Pimcore - CVE-2026-45162
Published: June 15, 2026
Vulnerability identifier: #VU134519
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45162
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in multiple unserialize() call sites in Pimcore when processing serialized data from database columns or filesystem files. A remote privileged user can inject a serialized PHP gadget chain into a controllable data source to execute arbitrary code.
Exploitation requires control over a referenced database or filesystem data source through a separate write primitive, such as SQL injection or a file write vulnerability.
Affected software
Pimcore
How to mitigate CVE-2026-45162
Install security update from vendor's website.
Pimcore - update to 11.5.17