Is CVE-2026-11407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11407 being exploited in the wild.

How severe is CVE-2026-11407?

High severity, with a CVSS score of 7.2, published 17 June 2026.

Which products and versions are affected?

pimcore/pimcore (Packagist) <= 12.3.8, ECOSYSTEM:introduced=12.0.0-RC1,last_affected=12.3.8; Pimcore <= 12.3.8.

Is there a fix for CVE-2026-11407?

A patch was published on 2026-06-17: Fix commit merged into main repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11407 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-11407?

Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11407: Pimcore CMS/DXP Twig sandbox bypass in SecurityPolicy

Q: Is there a fix for CVE-2026-11407?

A patch was published on 2026-06-17: Fix commit merged into main repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-11407 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-11407?

Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11407 · Severity: high · CVSS 7.2 · Published 2026-06-17

Pimcore CMS/DXP, a platform for managing digital content and customer experiences, contains a security flaw in its template engine. An authorized administrator can bypass security restrictions to run unauthorized commands on the server. This could lead to the theft of sensitive data, unauthorized database access, or full control over the underlying web server.

Technologies: pimcore/pimcore (Packagist), Pimcore. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-11407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11407 being exploited in the wild.
How severe is CVE-2026-11407?: High severity, with a CVSS score of 7.2, published 17 June 2026.
Which products and versions are affected?: pimcore/pimcore (Packagist) <= 12.3.8, ECOSYSTEM:introduced=12.0.0-RC1,last_affected=12.3.8; Pimcore <= 12.3.8.
Is there a fix for CVE-2026-11407?: A patch was published on 2026-06-17: Fix commit merged into main repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11407 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-11407?: Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A sandbox bypass vulnerability exists in Pimcore CMS/DXP version 12.3.8 due to improper neutralization of special elements in the Twig template engine (CWE-1336). The root cause is the empty implementation of checkMethodAllowed() and checkPropertyAllowed() in the custom Twig SecurityPolicy, combined with a wildcard bypass for pimcore_* functions. An authenticated attacker with administrative privileges can exploit this by supplying malicious Twig templates through the DataObject ClassDefinition Layout\Text component. Successful exploitation allows for arbitrary file reads, database queries, and potential remote code execution via PHP object gadget chains. A fix has been merged into the 12.3 branch and is tracked for the 12.3.10 milestone.

Affected products

Pimcore Pimcore CMS/DXP <= 12.3.8

Identifiers

CVE-2026-11407
GHSA-7p36-fq2r-4h7r

Timeline

2026-06-16: other: Fix pull request submitted
2026-06-17: disclosed: Vulnerability disclosed and CVE published
2026-06-17: patched: Fix commit merged into main repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.