CVE-2026-45162CWE-502

Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

High · published July 17, 2026

CVSS v3.1
8.0
EPSS
1%
Percentile
62.0
In the wild
Unconfirmed
What it is

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00987 · 62.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-07-17T18:50Z
EPSS history
Timeline
  • 17 JUL 18:50Z
    Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
    cvelistv5