https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T07:03:03.197798+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-06256 bdu:2024-06256 2026-10-09T07:03:03.201976+00:00 bdu:2024-06256 https://cve.radiocsirt.org/vuln/euvd-2026-6426 EUVD-2026-6426 2026-10-09T07:03:03.202015+00:00 EUVD-2026-6426 https://cve.radiocsirt.org/vuln/fkie_cve-2024-41109 fkie_cve-2024-41109 2026-10-09T07:03:03.202029+00:00

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.

 https://cve.radiocsirt.org/vuln/ghsa-fx6j-9pp6-ph36 GHSA-fx6j-9pp6-ph36 — Pimcore vulnerable to disclosure of system and database information behind /admin firewall 2026-10-09T07:03:03.202060+00:00

Affected: Packagist: pimcore/admin-ui-classic-bundle

### Summary

Navigating to `/admin/index/statistics` with a **logged in Pimcore user** (not an XmlHttpRequest because of this check: [IndexController:125](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/IndexController.php#L125C24-L125C40)) exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system.

> The web server should not return any product and version information of the components used. The table names and row counts should not be exposed.

### Details

`/admin/index/statistics` returns the following JSON-response: ``` { { "instanceId": "...", "pimcore_major_version": 11, "pimcore_version": "v11.3.1", "pimcore_hash": "3ecd39f21dbdd25ffdf4bec6e2c860eccfd3d008", "pimcore_platform_version": "v2024.2", "php_version": "8.3.8", "mysql_version": "10.11.8-MariaDB-ubu2204", "bundles": [ // all installed bundles ], "tables": [ // all tables and their row count, e.g: { "name": "users", "rows": 2 }, ] } ```

Information about the Pimcore Version can also be seen here:

In a current Version: ![[image](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2)](https://github.com/user-attachments/assets/f0f478da-ceca-4bd5-a391-3fe8458fa3d2) ![[image](https://github.com/user-attachments/assets/152f6ad7-2…