Executive brief
Pimcore is an open-source platform used by businesses to manage digital data and customer experiences. A security vulnerability allows an authorized user with document editing permissions to insert malicious scripts into the platform. When other users or visitors view the affected page, these scripts could execute, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Pimcore v12.3.3 within the 'Document embed editable' component. The root cause is improper neutralization of user-supplied input (CWE-79) during web page generation. An authenticated attacker with low-level privileges (specifically the permission to edit document content) can inject malicious HTML or JavaScript. This payload is stored on the server and executes in the context of any user who subsequently views the published page. This can lead to session hijacking, unauthorized data access, or redirection to malicious sites. At the time of the advisory, the vulnerability was confirmed in version 12.3.3.
Affected products
- Pimcore Pimcore 12.3.3
Timeline
- 2026-04-27: disclosed: Initial disclosure by Fluid Attacks
- 2026-04-27: advisory: NVD publication date