Is CVE-2026-41249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41249 being exploited in the wild.

How severe is CVE-2026-41249?

High severity, with a CVSS score of 8.2, published 4 June 2026.

Which products and versions are affected?

CoreShop 5.0.0, 5.0.1 - 5.1.0-beta.1; coreshop/core-shop (Packagist) = 5.0.0.

Is there a fix for CVE-2026-41249?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41249 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-41249?

Check whether you run CoreShop or coreshop/core-shop (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41249: coreshop CoreShop RCE via insecure pull_request_target in GitHub Actions

CVE-2026-41249 · Severity: high · CVSS 8.2 · Published 2026-06-04

CoreShop is an e-commerce framework for Pimcore. A security flaw in its automated testing processes allows an external attacker to execute malicious code on the project's build servers by submitting a specially crafted pull request. This could lead to the theft of sensitive repository secrets, such as product keys and API credentials, or unauthorized modifications to the software's source code.

Technologies: CoreShop, coreshop/core-shop (Packagist). Vendors: CoreShop, Packagist.

Quick answers

Is CVE-2026-41249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41249 being exploited in the wild.
How severe is CVE-2026-41249?: High severity, with a CVSS score of 8.2, published 4 June 2026.
Which products and versions are affected?: CoreShop 5.0.0, 5.0.1 - 5.1.0-beta.1; coreshop/core-shop (Packagist) = 5.0.0.
Is there a fix for CVE-2026-41249?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41249 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-41249?: Check whether you run CoreShop or coreshop/core-shop (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GitHub Actions workflow located at `.github/workflows/static.yml` utilizes the `pull_request_target` trigger while checking out code from the head of the pull request (`github.event.pull_request.head.ref`). Because `pull_request_target` runs with elevated privileges and access to repository secrets, an attacker can submit a pull request containing a modified `bin/console` script. When the workflow executes this script, it runs the attacker's code within the runner environment. This allows for the exfiltration of secrets like `PIMCORE_SECRET` and `PIMCORE_PRODUCT_KEY`. The vulnerability is a classic 'Pwn Request' scenario resulting from executing untrusted code in a privileged workflow context.

Affected products

CoreShop CoreShop 5.0.0

Identifiers

CVE-2026-41249
GHSA-q58j-g3f4-h26h

Timeline

2026-05-13: disclosed
2026-05-14: advisory: GHSA-q58j-g3f4-h26h published
2026-06-04: other: NVD published CVE-2026-41249

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.