Skip to content
Threat Feed
Subscribe

Product

Pimcore (<= V2026.1.4, <= V12.3.8)

1 brief RSS
high advisory

Pimcore Unrestricted Deserialization via Object-Store Columns

Pimcore components including Hotspotimage, ImageGallery, Block, and Video perform insecure PHP deserialization on database-stored metadata, enabling remote code execution via object injection.

Pimcore php-injection deserialization rce
1t