https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T19:08:26.605844+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338596 EUVD-2026-338596 2026-10-05T19:08:26.659397+00:00 EUVD-2026-338596 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45162 fkie_cve-2026-45162 2026-10-05T19:08:26.659444+00:00

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

 https://cve.radiocsirt.org/vuln/ghsa-36fc-7wjg-mfvj GHSA-36fc-7wjg-mfvj — Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction 2026-10-05T19:08:26.659491+00:00

Affected: Packagist: pimcore/pimcore

# GitHub Security Advisory Draft — GM-374

## Summary Multiple locations in Pimcore v11 call PHP's `unserialize()` on data from database columns and filesystem files without the `allowed_classes` restriction, enabling object injection if an attacker can control the serialized data source.

## Severity CVSS 3.1: 8.0 (High) — AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

## Affected Component - **Package:** `pimcore/pimcore` and `pimcore/admin-ui-classic-bundle` - **Files:** - `lib/Tool/Authentication.php` (line 82) — session token deserialization - `models/Site/Dao.php` (line 68) — site domains from database - `models/DataObject/ClassDefinition/CustomLayout/Dao.php` (line 69) — layout definitions from database - `models/Tool/TmpStore/Dao.php` (line 64) — temporary store data from database - `models/Asset/WebDAV/Service.php` (line 36) — delete log from filesystem - `admin-ui-classic-bundle/src/Helper/Dashboard.php` (line 64) — dashboard config from filesystem

## Description Six locations in Pimcore core call `unserialize()` directly (bypassing `Tool\Serialize`) on data sourced from database columns or filesystem files without passing the `allowed_classes` parameter. This means any class available in the autoloader will be instantiated during deserialization.

If an attacker can write to the data source (e.g., via SQL injection targeting the `tmp_store`, `sites`, or `custom_layouts` tables, or via a file write vulnerability targeting the WebDAV delete log), they can inject…