# CVE-2026-5362: Pimcore stored XSS in Document embed editable

Source: https://junglewise.ai/threats/cve-2026-5362-pimcore-stored-xss-in-document-embed-editable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-27. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-5362 · Severity: medium · CVSS 5.4 · Published 2026-04-27

Pimcore is an open-source platform used by businesses to manage digital data and customer experiences. A security vulnerability allows an authorized user with document editing permissions to insert malicious scripts into the platform. When other users or visitors view the affected page, these scripts could execute, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore), [Pimcore](https://junglewise.ai/threats/technologies/pimcore). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pimcore](https://junglewise.ai/threats/vendors/pimcore).

## Quick answers

**Is CVE-2026-5362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5362 being exploited in the wild.

**How severe is CVE-2026-5362?** Medium severity, with a CVSS score of 5.4, published 27 April 2026.

**Which products and versions are affected?** Pimcore 12.3.3.

**Is there a fix for CVE-2026-5362?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5362 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5362?** Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Pimcore v12.3.3 within the 'Document embed editable' component. The root cause is improper neutralization of user-supplied input (CWE-79) during web page generation. An authenticated attacker with low-level privileges (specifically the permission to edit document content) can inject malicious HTML or JavaScript. This payload is stored on the server and executes in the context of any user who subsequently views the published page. This can lead to session hijacking, unauthorized data access, or redirection to malicious sites. At the time of the advisory, the vulnerability was confirmed in version 12.3.3.

## Affected products

- Pimcore Pimcore 12.3.3

## Identifiers

- CVE-2026-5362
- GHSA-7gxw-q9j5-mrj4

## Timeline

- 2026-04-27: disclosed: Initial disclosure by Fluid Attacks
- 2026-04-27: advisory: NVD publication date

## References

- [https://fluidattacks.com/es/advisories/mago](https://fluidattacks.com/es/advisories/mago)
- [https://github.com/pimcore/pimcore/](https://github.com/pimcore/pimcore/)

## Related threats

- [Pimcore stored cross-site scripting in data objects](https://junglewise.ai/threats/cve-2026-109392-pimcore-through-2026-3-1-contains-a-stored-cross-site-scripting)
- [Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration)
- [Pimcore ClassDefinition UID regex SQL injection in Block.php](https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php)
- [Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code)
- [Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization)