{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pimcore--v2026.1.4--v12.3.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pimcore (\u003c= v2026.1.4, \u003c= v12.3.8)"],"_cs_severities":["high"],"_cs_tags":["php-injection","deserialization","rce","pimcore"],"_cs_type":"advisory","_cs_vendors":["Pimcore"],"content_html":"\u003cp\u003ePimcore is vulnerable to PHP Object Injection (CWE-502) due to insecure deserialization practices within its data object model. Specifically, the \u003ccode\u003egetDataFromResource()\u003c/code\u003e method in \u003ccode\u003ePimcore\\Model\\DataObject\\ClassDefinition\\Data\\Hotspotimage\u003c/code\u003e and sibling marshallers (\u003ccode\u003eImageGallery\u003c/code\u003e, \u003ccode\u003eBlock\u003c/code\u003e, and \u003ccode\u003eVideo\u003c/code\u003e) perform an unrestricted \u003ccode\u003eunserialize()\u003c/code\u003e call on data read from object-store database columns.\u003c/p\u003e\n\u003cp\u003eThe vulnerability exists because these components use \u003ccode\u003ePimcore\\Tool\\Serialize::unserialize()\u003c/code\u003e as a fallback for JSON decoding. The \u003ccode\u003eunserialize()\u003c/code\u003e wrapper defaults to an unrestricted class allowlist, allowing any PHP class present in the application scope to be instantiated. Attackers who can influence the content of the \u003ccode\u003e*__hotspots\u003c/code\u003e object-store columns - for instance, via a separate storage-write or SQL injection primitive - can inject crafted serialized PHP payloads. Upon the next retrieval and loading of the DataObject, the application instantiates these objects and triggers their magic methods (such as \u003ccode\u003e__wakeup\u003c/code\u003e or \u003ccode\u003e__destruct\u003c/code\u003e), enabling Remote Code Execution (RCE) via gadget chains, such as those found in the bundled \u003ccode\u003eguzzlehttp/guzzle\u003c/code\u003e library.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains a write primitive to the Pimcore database, specifically targeting the \u003ccode\u003e*__hotspots\u003c/code\u003e columns in object-store tables.\u003c/li\u003e\n\u003cli\u003eAttacker selects a gadget chain present in the application's dependencies (e.g., \u003ccode\u003eGuzzleHttp\\Cookie\\FileCookieJar\u003c/code\u003e in \u003ccode\u003eguzzlehttp/guzzle\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious serialized PHP payload using a tool like \u003ccode\u003ephpggc\u003c/code\u003e to target the chosen gadget.\u003c/li\u003e\n\u003cli\u003eAttacker executes an SQL \u003ccode\u003eUPDATE\u003c/code\u003e statement to overwrite the target object's column with the malicious serialized bytes.\u003c/li\u003e\n\u003cli\u003eThe application retrieves the affected DataObject from the database through the standard model loading layer.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eHotspotimage::getDataFromResource()\u003c/code\u003e method is invoked during object hydration, attempting to JSON decode the payload, which fails.\u003c/li\u003e\n\u003cli\u003eThe application falls back to \u003ccode\u003eSerialize::unserialize()\u003c/code\u003e, which deserializes the malicious bytes without an allowlist.\u003c/li\u003e\n\u003cli\u003eMagic methods trigger, executing the gadget chain and achieving the attacker's final objective (e.g., arbitrary file write or RCE).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution on the Pimcore server. This vulnerability affects all currently maintained versions, including \u003ccode\u003ev2026.1.4\u003c/code\u003e and \u003ccode\u003ev12.3.8\u003c/code\u003e. Because these components are heavily used in DataObject management, an attacker with low-level write access to the database can achieve full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately audit all custom code and database access layers that interact with object-store columns to prevent unauthorized write access to the metadata columns.\u003c/li\u003e\n\u003cli\u003eApply upcoming patches from the Pimcore vendor that implement a strictly constrained class allowlist in \u003ccode\u003ePimcore\\Tool\\Serialize::unserialize()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAs a temporary mitigation, implement a WAF or database firewall rule to inspect and block serialized PHP strings (e.g., \u003ccode\u003eO:\\d+:\u0026quot;\u003c/code\u003e) within SQL queries directed at the application database.\u003c/li\u003e\n\u003cli\u003ePerform periodic integrity checks on \u003ccode\u003e*__hotspots\u003c/code\u003e columns in object-store tables to identify unexpected serialized payloads that deviate from standard JSON formatting.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-28T21:13:13Z","date_published":"2026-08-28T21:13:13Z","id":"https://feed.craftedsignal.io/briefs/2026-08-pimcore-deserialization/","summary":"Pimcore components including Hotspotimage, ImageGallery, Block, and Video perform insecure PHP deserialization on database-stored metadata, enabling remote code execution via object injection.","title":"Pimcore Unrestricted Deserialization via Object-Store Columns","url":"https://feed.craftedsignal.io/briefs/2026-08-pimcore-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Pimcore (\u003c= V2026.1.4, \u003c= V12.3.8)","version":"https://jsonfeed.org/version/1.1"}