Executive brief
CoreShop is an e-commerce framework for Pimcore. A security flaw in its automated testing processes allows an external attacker to execute malicious code on the project's build servers by submitting a specially crafted pull request. This could lead to the theft of sensitive repository secrets, such as product keys and API credentials, or unauthorized modifications to the software's source code.
Technical details
The GitHub Actions workflow located at `.github/workflows/static.yml` utilizes the `pull_request_target` trigger while checking out code from the head of the pull request (`github.event.pull_request.head.ref`). Because `pull_request_target` runs with elevated privileges and access to repository secrets, an attacker can submit a pull request containing a modified `bin/console` script. When the workflow executes this script, it runs the attacker's code within the runner environment. This allows for the exfiltration of secrets like `PIMCORE_SECRET` and `PIMCORE_PRODUCT_KEY`. The vulnerability is a classic 'Pwn Request' scenario resulting from executing untrusted code in a privileged workflow context.
Affected products
- CoreShop CoreShop 5.0.0
Timeline
- 2026-05-13: disclosed
- 2026-05-14: advisory: GHSA-q58j-g3f4-h26h published
- 2026-06-04: other: NVD published CVE-2026-41249
References
- https://api.github.com/users/smiotani-aeyesec
- https://github.com/smiotani-aeyesec
- https://api.github.com/users/smiotani-aeyesec/gists%7B/gist_id%7D
- https://api.github.com/users/smiotani-aeyesec/repos
- https://avatars.githubusercontent.com/u/229667752?v=4
- https://api.github.com/users/smiotani-aeyesec/events%7B/privacy%7D