https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-24T03:47:13.924820+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-233454 EUVD-2026-233454 2026-10-24T03:47:13.927601+00:00 EUVD-2026-233454 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39365 fkie_cve-2022-39365 2026-10-24T03:47:13.927632+00:00

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contains a patch for this issue. As a workaround, one may apply the patch manually.

 https://cve.radiocsirt.org/vuln/ghsa-5qxq-vgmm-q39m GHSA-5qxq-vgmm-q39m — RCE vulnerability in Pimcore/Mail & Dynamic Text Layout 2026-10-24T03:47:13.927664+00:00

Affected: Packagist: pimcore/pimcore

### Impact The user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template Injection RCE.

### Patches Update to version 10.5.9 or apply this patch manually https://github.com/pimcore/pimcore/pull/13347.patch

### Workarounds Apply https://github.com/pimcore/pimcore/pull/13347.patch manually.

### References Credits: @nth347 from Viettel Cyber Security

 https://cve.radiocsirt.org/vuln/gsd-2022-39365 gsd-2022-39365 2026-10-24T03:47:13.927692+00:00 gsd-2022-39365