{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pimcore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pimcore"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","sqli","pimcore"],"_cs_type":"advisory","_cs_vendors":["Pimcore"],"content_html":"\u003cp\u003ePimcore versions 2026.1.0 through 2026.1.4 and versions prior to 12.3.9 are vulnerable to SQL injection (CVE-2026-55072). The vulnerability stems from an incomplete fix regarding input validation of ClassDefinition UIDs. The regex used to validate the UID lacks an end anchor (\u003ccode\u003e$\u003c/code\u003e), allowing a user with 'objects' permissions to supply a string that starts with a valid character but contains additional malicious SQL.\u003c/p\u003e\n\u003cp\u003eWhen this class is subsequently instantiated and accessed via a 'Block' field, the \u003ccode\u003eBlock.php\u003c/code\u003e component concatenates the raw, unquoted classId directly into SQL queries. This allows an attacker to break out of the intended query context and execute arbitrary SQL commands. An attacker can leverage this to exfiltrate sensitive data, including password hashes from the \u003ccode\u003eusers\u003c/code\u003e table, by performing a UNION-based SQL injection attack.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Pimcore Studio API with valid 'objects' level credentials.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the \u003ccode\u003ecreate\u003c/code\u003e action on the \u003ccode\u003eClassDefinition\u003c/code\u003e configuration endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker submits a specially crafted \u003ccode\u003euid\u003c/code\u003e parameter containing a SQL payload (e.g., \u003ccode\u003e1 UNION SELECT...\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application processes the \u003ccode\u003euid\u003c/code\u003e using an insufficiently anchored regex, which passes validation.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a new data object associated with this malicious class definition.\u003c/li\u003e\n\u003cli\u003eAttacker requests the data object via the API, triggering \u003ccode\u003eBlock.php\u003c/code\u003e to load field data.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eBlock.php\u003c/code\u003e performs an unquoted string concatenation of the classId into a database query.\u003c/li\u003e\n\u003cli\u003eThe underlying database executes the injected payload, returning sensitive table contents in the API response.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated editor-level user to perform arbitrary SQL queries against the application database. This enables unauthorized exfiltration of sensitive information, including user credentials and configuration data. The impact is significant as it requires only standard editor permissions, facilitating privilege escalation via credential access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a patched version of Pimcore that addresses CVE-2026-55072 immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing \u003ccode\u003eClassDefinition\u003c/code\u003e entries for UIDs containing non-alphanumeric characters or suspicious SQL keywords.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules below to monitor for suspicious POST requests to the \u003ccode\u003eClassDefinition\u003c/code\u003e creation and data object retrieval endpoints.\u003c/li\u003e\n\u003cli\u003eEnsure database users operate with the principle of least privilege, specifically restricting access to sensitive tables like \u003ccode\u003eusers\u003c/code\u003e from the web application user.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-13T14:21:45Z","date_published":"2026-08-13T14:21:45Z","id":"https://feed.craftedsignal.io/briefs/2026-08-pimcore-sql-injection/","summary":"An improper input validation in Pimcore's ClassDefinition UID and unsanitized SQL query construction allow authenticated users to perform UNION-based SQL injection and exfiltrate database contents.","title":"SQL Injection in Pimcore via ClassDefinition UID","url":"https://feed.craftedsignal.io/briefs/2026-08-pimcore-sql-injection/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-5394"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pimcore/pimcore (\u003c= 12.3.6)"],"_cs_severities":["high"],"_cs_tags":["sql-injection","web-application","pimcore"],"_cs_type":"advisory","_cs_vendors":["Pimcore"],"content_html":"\u003cp\u003ePimcore Platform is vulnerable to SQL injection in the handling of DataObject composite indices during class definition import and save. An authenticated administrative user with the ability to import or save DataObject class definitions can inject attacker-controlled composite index metadata, leading to unintended SQL execution in the backend. The vulnerability lies in the lack of proper validation of the \u003ccode\u003eindex_columns\u003c/code\u003e element within \u003ccode\u003ecompositeIndices\u003c/code\u003e, which is directly concatenated into \u003ccode\u003eALTER TABLE\u003c/code\u003e statements. This allows for the injection of arbitrary SQL, potentially leading to unauthorized schema modification, denial of service, and data integrity compromise. The issue affects Pimcore versions up to and including 12.3.6, with the vulnerability residing in the \u003ccode\u003ecompositeIndices\u003c/code\u003e handling during class definition import/save operations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker authenticates as an administrative user with privileges to manage DataObject class definitions.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious JSON payload containing a \u003ccode\u003ecompositeIndices\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eWithin the \u003ccode\u003ecompositeIndices\u003c/code\u003e section, the attacker injects SQL code into the \u003ccode\u003eindex_columns\u003c/code\u003e field. For example: \u003ccode\u003e\u0026quot;slider), DROP COLUMN \\\u003c/code\u003eoo_className` -- \u0026quot;`\u003c/li\u003e\n\u003cli\u003eThe attacker imports the crafted JSON payload via the \u003ccode\u003e/pimcore-studio/api/class/definition/configuration-view/detail/1/import\u003c/code\u003e endpoint or saves the class definition through the administrative workflow.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eimportClassDefinitionFromJson()\u003c/code\u003e decodes the attacker-controlled JSON and forwards \u003ccode\u003ecompositeIndices\u003c/code\u003e to \u003ccode\u003esetCompositeIndices()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003esetCompositeIndices()\u003c/code\u003e stores the values without sanitizing identifier content.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eClassDefinition::save()\u003c/code\u003e reaches \u003ccode\u003eClassDefinition\\Dao::update()\u003c/code\u003e which then calls \u003ccode\u003eupdateCompositeIndices()\u003c/code\u003e on tables like \u003ccode\u003eobject_store_\u0026lt;classId\u0026gt;\u003c/code\u003e and \u003ccode\u003eobject_query_\u0026lt;classId\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe injected SQL code is concatenated into an \u003ccode\u003eALTER TABLE\u003c/code\u003e statement, which is then executed against the Pimcore database via Doctrine DBAL, leading to unintended schema modifications.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe SQL injection vulnerability allows a privileged attacker to alter backend SQL behavior during class-definition import/save, resulting in schema modification on Pimcore object tables. This can lead to unauthorized schema changes, backend denial of service by breaking expected table layouts, and data integrity issues for DataObject storage and queries. Versions up to and including v12.3.6 are vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Pimcore SQL Injection via Composite Index Manipulation\u0026quot; to your SIEM and tune for your environment to detect exploitation attempts (rules).\u003c/li\u003e\n\u003cli\u003eApply input validation and sanitization to the \u003ccode\u003eindex_columns\u003c/code\u003e field in \u003ccode\u003ePimcore\\Model\\DataObject\\ClassDefinition::setCompositeIndices()\u003c/code\u003e to prevent SQL injection (code).\u003c/li\u003e\n\u003cli\u003eUpgrade Pimcore to a patched version that addresses CVE-2026-5394 when available.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for POST requests to \u003ccode\u003e/pimcore-studio/api/class/definition/configuration-view/detail/*/import\u003c/code\u003e with suspicious characters in the \u003ccode\u003ecompositeIndices\u003c/code\u003e parameter (logs).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-28T20:47:45Z","date_published":"2026-05-28T20:47:45Z","id":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-sqli/","summary":"A SQL injection vulnerability exists in Pimcore Platform when handling DataObject composite indices during class definition import/save, allowing an authenticated administrative user to inject attacker-controlled composite index metadata, leading to unintended SQL execution in the backend, specifically via the `index_columns` element.","title":"Pimcore Platform SQL Injection in DataObject Composite Index Handling","url":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-sqli/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pimcore/pimcore (\u003c= 12.3.6)"],"_cs_severities":["high"],"_cs_tags":["webdav","asset-management","missing-authorization","pimcore"],"_cs_type":"advisory","_cs_vendors":["Pimcore"],"content_html":"\u003cp\u003ePimcore, a PHP-based platform for managing digital data, contains a vulnerability in its WebDAV asset endpoint that allows unauthorized asset manipulation. The vulnerability, identified as CVE-2026-45260, stems from a missing authentication plugin in the WebDAV controller, specifically impacting the \u003ccode\u003eMOVE\u003c/code\u003e operation. This oversight enables unauthenticated remote attackers, who possess knowledge of two existing asset paths within the same directory, to send a crafted WebDAV request and delete the source asset. Moreover, authenticated low-privileged users can exploit this flaw to perform unauthorized asset move or overwrite operations due to the absence of proper permission checks along the move path. This can lead to data loss and service disruption. The affected versions are Pimcore 12.3.6 and earlier.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies two existing asset paths in the same directory on a Pimcore instance (e.g., \u003ccode\u003e/products/source.jpg\u003c/code\u003e and \u003ccode\u003e/products/existing.jpg\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a WebDAV \u003ccode\u003eMOVE\u003c/code\u003e request targeting the source asset (\u003ccode\u003e/products/source.jpg\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eDestination\u003c/code\u003e header of the \u003ccode\u003eMOVE\u003c/code\u003e request is set to the path of the destination asset (\u003ccode\u003e/products/existing.jpg\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eOverwrite\u003c/code\u003e header is set to \u003ccode\u003eT\u003c/code\u003e, indicating that the destination asset should be overwritten if it exists.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the crafted \u003ccode\u003eMOVE\u003c/code\u003e request to the \u003ccode\u003e/asset/webdav\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe Pimcore server receives the request and, due to the missing authentication plugin, processes it without verifying the attacker's identity.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eTree::move()\u003c/code\u003e function is executed, which deletes the source asset (\u003ccode\u003e/products/source.jpg\u003c/code\u003e) via the \u003ccode\u003eAsset::delete()\u003c/code\u003e function \u003cem\u003ebefore\u003c/em\u003e checking for a valid user session or asset permissions.\u003c/li\u003e\n\u003cli\u003eThe server attempts to set the \u003ccode\u003euserModification\u003c/code\u003e field but fails because there's no authenticated user, triggering an error. Despite the error, the source asset has already been deleted.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows for the unauthorized deletion of assets in Pimcore. An unauthenticated attacker can remotely delete assets if they know the paths. In Pimcore deployments where assets represent product images, documents, media, or DAM-managed business content, this deletion or unauthorized overwrite can cause data loss, content integrity loss, and service disruption. The affected package is \u003ccode\u003ecomposer/pimcore/pimcore\u003c/code\u003e in versions 12.3.6 and earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the necessary patches to upgrade Pimcore to a version greater than 12.3.6 to address CVE-2026-45260.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Pimcore WebDAV Unauthorized Asset MOVE\u0026quot; to identify potential exploitation attempts against the \u003ccode\u003e/asset/webdav\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for \u003ccode\u003eMOVE\u003c/code\u003e requests targeting the \u003ccode\u003e/asset/webdav\u003c/code\u003e endpoint as described in the attack chain.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-27T17:20:01Z","date_published":"2026-05-27T17:20:01Z","id":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-webdav-asset-move/","summary":"Pimcore's WebDAV asset endpoint exposes a `MOVE` operation without authentication, allowing unauthenticated remote attackers to delete assets if they know two existing asset paths in the same directory; Authenticated low-privileged users may also be able to perform unauthorized asset move or overwrite operations because the move path does not enforce `rename`, `delete`, `create`, or `publish` permissions, leading to data loss, content integrity loss, and service disruption.","title":"Pimcore WebDAV Asset MOVE Missing Authorization Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-webdav-asset-move/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pimcore/pimcore","pimcore/admin-ui-classic-bundle"],"_cs_severities":["high"],"_cs_tags":["deserialization","remote code execution","php"],"_cs_type":"advisory","_cs_vendors":["Pimcore"],"content_html":"\u003cp\u003ePimcore, a content management framework, contains a critical vulnerability (CVE-2026-45162) due to unsafe PHP deserialization in version 11 and earlier. The vulnerability stems from the use of \u003ccode\u003eunserialize()\u003c/code\u003e in multiple locations without the \u003ccode\u003eallowed_classes\u003c/code\u003e restriction. This oversight allows attackers to inject arbitrary PHP objects if they can control the serialized data. The affected locations include \u003ccode\u003elib/Tool/Authentication.php\u003c/code\u003e, \u003ccode\u003emodels/Site/Dao.php\u003c/code\u003e, \u003ccode\u003emodels/DataObject/ClassDefinition/CustomLayout/Dao.php\u003c/code\u003e, \u003ccode\u003emodels/Tool/TmpStore/Dao.php\u003c/code\u003e, \u003ccode\u003emodels/Asset/WebDAV/Service.php\u003c/code\u003e, and \u003ccode\u003eadmin-ui-classic-bundle/src/Helper/Dashboard.php\u003c/code\u003e. The data being deserialized is sourced from database columns and filesystem files. Exploitation requires an attacker to be able to write to these data sources, which can be achieved through SQL injection or file write vulnerabilities. Successful exploitation leads to remote code execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a writable data source, such as the \u003ccode\u003etmp_store\u003c/code\u003e table or the \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe attacker gains write access to the chosen data source, for example via SQL injection against the \u003ccode\u003etmp_store\u003c/code\u003e table or a file write vulnerability against \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious serialized PHP object, containing a gadget chain designed for remote code execution (e.g., using Monolog's BufferHandler).\u003c/li\u003e\n\u003cli\u003eThe attacker writes the malicious serialized data to the targeted data source (e.g., inserting a row into \u003ccode\u003etmp_store\u003c/code\u003e with the serialized payload, or writing to \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eA user action or scheduled task triggers the vulnerable \u003ccode\u003eunserialize()\u003c/code\u003e call in one of the affected files (e.g., accessing a page that reads from \u003ccode\u003eTmpStore\u003c/code\u003e, or triggering a WebDAV operation that uses the delete log).\u003c/li\u003e\n\u003cli\u003eThe PHP \u003ccode\u003eunserialize()\u003c/code\u003e function processes the attacker-controlled serialized data without \u003ccode\u003eallowed_classes\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe injected PHP object is instantiated, and its methods are invoked according to the gadget chain.\u003c/li\u003e\n\u003cli\u003eThe gadget chain executes arbitrary PHP code with the privileges of the web server, resulting in remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary PHP code on the Pimcore server. This can lead to complete compromise of the application, including data theft, modification, or deletion. The impact is amplified by the availability of public exploit techniques and gadget chains. Given Pimcore's use in content management and e-commerce, a successful attack could have significant financial and reputational consequences.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the vendor-supplied patch or upgrade to a version of Pimcore that addresses CVE-2026-45162.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided in this brief to your SIEM and tune them for your environment to detect potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious activity related to database access (e.g., SQL injection attempts) that could be used to inject malicious serialized data into database tables.\u003c/li\u003e\n\u003cli\u003eImplement strict file permission controls on the web server to prevent unauthorized writing to the filesystem, mitigating the risk of injecting serialized data into files like \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-27T16:58:21Z","date_published":"2026-05-27T16:58:21Z","id":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-deserialization/","summary":"Pimcore v11 and earlier is vulnerable to unsafe PHP deserialization in multiple locations due to missing `allowed_classes` restrictions when calling `unserialize()` on data from database columns and filesystem files; an attacker with control over serialized data sources (e.g., via SQL injection or file write vulnerabilities) can inject PHP gadget chains, leading to remote code execution.","title":"Pimcore Unsafe PHP Deserialization Vulnerability (CVE-2026-45162)","url":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-deserialization/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pimcore/pimcore","pimcore/admin-ui-classic-bundle"],"_cs_severities":["high"],"_cs_tags":["deserialization","remote code execution","php"],"_cs_type":"advisory","_cs_vendors":["Pimcore"],"content_html":"\u003cp\u003ePimcore, a content management framework, contains a critical vulnerability (CVE-2026-45162) due to unsafe PHP deserialization in version 11 and earlier. The vulnerability stems from the use of \u003ccode\u003eunserialize()\u003c/code\u003e in multiple locations without the \u003ccode\u003eallowed_classes\u003c/code\u003e restriction. This oversight allows attackers to inject arbitrary PHP objects if they can control the serialized data. The affected locations include \u003ccode\u003elib/Tool/Authentication.php\u003c/code\u003e, \u003ccode\u003emodels/Site/Dao.php\u003c/code\u003e, \u003ccode\u003emodels/DataObject/ClassDefinition/CustomLayout/Dao.php\u003c/code\u003e, \u003ccode\u003emodels/Tool/TmpStore/Dao.php\u003c/code\u003e, \u003ccode\u003emodels/Asset/WebDAV/Service.php\u003c/code\u003e, and \u003ccode\u003eadmin-ui-classic-bundle/src/Helper/Dashboard.php\u003c/code\u003e. The data being deserialized is sourced from database columns and filesystem files. Exploitation requires an attacker to be able to write to these data sources, which can be achieved through SQL injection or file write vulnerabilities. Successful exploitation leads to remote code execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a writable data source, such as the \u003ccode\u003etmp_store\u003c/code\u003e table or the \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe attacker gains write access to the chosen data source, for example via SQL injection against the \u003ccode\u003etmp_store\u003c/code\u003e table or a file write vulnerability against \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious serialized PHP object, containing a gadget chain designed for remote code execution (e.g., using Monolog's BufferHandler).\u003c/li\u003e\n\u003cli\u003eThe attacker writes the malicious serialized data to the targeted data source (e.g., inserting a row into \u003ccode\u003etmp_store\u003c/code\u003e with the serialized payload, or writing to \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eA user action or scheduled task triggers the vulnerable \u003ccode\u003eunserialize()\u003c/code\u003e call in one of the affected files (e.g., accessing a page that reads from \u003ccode\u003eTmpStore\u003c/code\u003e, or triggering a WebDAV operation that uses the delete log).\u003c/li\u003e\n\u003cli\u003eThe PHP \u003ccode\u003eunserialize()\u003c/code\u003e function processes the attacker-controlled serialized data without \u003ccode\u003eallowed_classes\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe injected PHP object is instantiated, and its methods are invoked according to the gadget chain.\u003c/li\u003e\n\u003cli\u003eThe gadget chain executes arbitrary PHP code with the privileges of the web server, resulting in remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary PHP code on the Pimcore server. This can lead to complete compromise of the application, including data theft, modification, or deletion. The impact is amplified by the availability of public exploit techniques and gadget chains. Given Pimcore's use in content management and e-commerce, a successful attack could have significant financial and reputational consequences.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the vendor-supplied patch or upgrade to a version of Pimcore that addresses CVE-2026-45162.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided in this brief to your SIEM and tune them for your environment to detect potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious activity related to database access (e.g., SQL injection attempts) that could be used to inject malicious serialized data into database tables.\u003c/li\u003e\n\u003cli\u003eImplement strict file permission controls on the web server to prevent unauthorized writing to the filesystem, mitigating the risk of injecting serialized data into files like \u003ccode\u003ewebdav-delete.dat\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-27T16:58:21Z","date_published":"2026-05-27T16:58:21Z","id":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-deserialization/","summary":"Pimcore v11 and earlier is vulnerable to unsafe PHP deserialization in multiple locations due to missing `allowed_classes` restrictions when calling `unserialize()` on data from database columns and filesystem files; an attacker with control over serialized data sources (e.g., via SQL injection or file write vulnerabilities) can inject PHP gadget chains, leading to remote code execution.","title":"Pimcore Unsafe PHP Deserialization Vulnerability (CVE-2026-45162)","url":"https://feed.craftedsignal.io/briefs/2026-05-pimcore-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Pimcore","version":"https://jsonfeed.org/version/1.1"}