Executive brief
Pimcore CMS/DXP, a platform for managing digital content and customer experiences, contains a security flaw in its template engine. An authorized administrator can bypass security restrictions to run unauthorized commands on the server. This could lead to the theft of sensitive data, unauthorized database access, or full control over the underlying web server.
Technical details
A sandbox bypass vulnerability exists in Pimcore CMS/DXP version 12.3.8 due to improper neutralization of special elements in the Twig template engine (CWE-1336). The root cause is the empty implementation of checkMethodAllowed() and checkPropertyAllowed() in the custom Twig SecurityPolicy, combined with a wildcard bypass for pimcore_* functions. An authenticated attacker with administrative privileges can exploit this by supplying malicious Twig templates through the DataObject ClassDefinition Layout\Text component. Successful exploitation allows for arbitrary file reads, database queries, and potential remote code execution via PHP object gadget chains. A fix has been merged into the 12.3 branch and is tracked for the 12.3.10 milestone.
Affected products
- Pimcore Pimcore CMS/DXP <= 12.3.8
Timeline
- 2026-06-16: other: Fix pull request submitted
- 2026-06-17: disclosed: Vulnerability disclosed and CVE published
- 2026-06-17: patched: Fix commit merged into main repository