Is CVE-2026-5362 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5362 being exploited in the wild.

How severe is CVE-2026-5362?

Medium severity, with a CVSS score of 5.4, published 27 April 2026.

Is there a fix for CVE-2026-5362?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5362 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5362?

Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5362: Pimcore stored XSS in Document embed editable

CVE-2026-5362 · Severity: medium · CVSS 5.4 · Published 2026-04-27

Pimcore is an open-source platform used by businesses to manage digital data and customer experiences. A security vulnerability allows an authorized user with document editing permissions to insert malicious scripts into the platform. When other users or visitors view the affected page, these scripts could execute, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: pimcore/pimcore (Packagist), Pimcore. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-5362 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5362 being exploited in the wild.
How severe is CVE-2026-5362?: Medium severity, with a CVSS score of 5.4, published 27 April 2026.
Which products and versions are affected?: Pimcore 12.3.3.
Is there a fix for CVE-2026-5362?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5362 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5362?: Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Pimcore v12.3.3 within the 'Document embed editable' component. The root cause is improper neutralization of user-supplied input (CWE-79) during web page generation. An authenticated attacker with low-level privileges (specifically the permission to edit document content) can inject malicious HTML or JavaScript. This payload is stored on the server and executes in the context of any user who subsequently views the published page. This can lead to session hijacking, unauthorized data access, or redirection to malicious sites. At the time of the advisory, the vulnerability was confirmed in version 12.3.3.

Affected products

Pimcore Pimcore 12.3.3

Identifiers

CVE-2026-5362
GHSA-7gxw-q9j5-mrj4

Timeline

2026-04-27: disclosed: Initial disclosure by Fluid Attacks
2026-04-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.