https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:42:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338596 EUVD-2026-338596 https://cve.radiocsirt.org/vuln/euvd-2026-338596 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45162 <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP&#39;s unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.</p> <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP&#39;s unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45162 https://cve.radiocsirt.org/vuln/ghsa-36fc-7wjg-mfvj <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p># GitHub Security Advisory Draft — GM-374</p> <p>## Summary Multiple locations in Pimcore v11 call PHP&#39;s `unserialize()` on data from database columns and filesystem files without the `allowed_classes` restriction, enabling object injection if an attacker can control the serialized data source.</p> <p>## Severity CVSS 3.1: 8.0 (High) — AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</p> <p>## Affected Component - **Package:** `pimcore/pimcore` and `pimcore/admin-ui-classic-bundle` - **Files:** - `lib/Tool/Authentication.php` (line 82) — session token deserialization - `models/Site/Dao.php` (line 68) — site domains from database - `models/DataObject/ClassDefinition/CustomLayout/Dao.php` (line 69) — layout definitions from database - `models/Tool/TmpStore/Dao.php` (line 64) — temporary store data from database - `models/Asset/WebDAV/Service.php` (line 36) — delete log from filesystem - `admin-ui-classic-bundle/src/Helper/Dashboard.php` (line 64) — dashboard config from filesystem</p> <p>## Description Six locations in Pimcore core call `unserialize()` directly (bypassing `Tool\Serialize`) on data sourced from database columns or filesystem files without passing the `allowed_classes` parameter. This means any class available in the autoloader will be instantiated during deserialization.</p> <p>If an attacker can write to the data source (e.g., via SQL injection targeting the `tmp_store`, `sites`, or `custom_layouts` tables, or via a file write vulnerability targeting the WebDAV delete log), they can inject…</p> <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p># GitHub Security Advisory Draft — GM-374</p> <p>## Summary Multiple locations in Pimcore v11 call PHP&#39;s `unserialize()` on data from database columns and filesystem files without the `allowed_classes` restriction, enabling object injection if an attacker can control the serialized data source.</p> <p>## Severity CVSS 3.1: 8.0 (High) — AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H</p> <p>## Affected Component - **Package:** `pimcore/pimcore` and `pimcore/admin-ui-classic-bundle` - **Files:** - `lib/Tool/Authentication.php` (line 82) — session token deserialization - `models/Site/Dao.php` (line 68) — site domains from database - `models/DataObject/ClassDefinition/CustomLayout/Dao.php` (line 69) — layout definitions from database - `models/Tool/TmpStore/Dao.php` (line 64) — temporary store data from database - `models/Asset/WebDAV/Service.php` (line 36) — delete log from filesystem - `admin-ui-classic-bundle/src/Helper/Dashboard.php` (line 64) — dashboard config from filesystem</p> <p>## Description Six locations in Pimcore core call `unserialize()` directly (bypassing `Tool\Serialize`) on data sourced from database columns or filesystem files without passing the `allowed_classes` parameter. This means any class available in the autoloader will be instantiated during deserialization.</p> <p>If an attacker can write to the data source (e.g., via SQL injection targeting the `tmp_store`, `sites`, or `custom_layouts` tables, or via a file write vulnerability targeting the WebDAV delete log), they can inject…</p> https://cve.radiocsirt.org/vuln/ghsa-36fc-7wjg-mfvj