# pimcore/pimcore (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/pimcore-pimcore Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pimcore-pimcore.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 145 vulnerabilities in pimcore/pimcore (Packagist): 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55416, was published on 14 September 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 145 (2 critical, 0 exploited in the wild) ## About pimcore/pimcore (Packagist) Pimcore is an open-source data management platform for product information management, master data management, and digital asset management. ## Latest pimcore/pimcore (Packagist) vulnerabilities - [CVE-2026-55416: Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration) (high, CVSS 8.8, published 14 Sep 2026) - [CVE-2026-55072: Pimcore ClassDefinition UID regex SQL injection in Block.php](https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php) (high, CVSS 8.5, published 14 Sep 2026) - [CVE-2026-55634: Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code) (critical, CVSS 9.9, published 28 Aug 2026) - [CVE-2026-55220: Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization) (critical, CVSS 4, published 28 Aug 2026) - [CVE-2026-45704: Pimcore CustomReports authorization bypass in report detail endpoint](https://junglewise.ai/threats/cve-2026-45704-pimcore-customreports-authorization-bypass-in-report-detail) (high, CVSS 4, published 17 Jul 2026) - [CVE-2026-45260: Pimcore missing authorization in WebDAV MOVE operation](https://junglewise.ai/threats/cve-2026-45260-pimcore-missing-authorization-in-webdav-move-operation) (high, CVSS 8.1, published 17 Jul 2026) - [CVE-2026-44739: Pimcore SQL injection in CustomReportsBundle columnConfigAction](https://junglewise.ai/threats/cve-2026-44739-pimcore-sql-injection-in-customreportsbundle-columnconfigaction) (high, CVSS 8.7, published 17 Jul 2026) - [CVE-2026-45703: Pimcore missing authorization in WordExportBundle](https://junglewise.ai/threats/cve-2026-45703-pimcore-missing-authorization-in-wordexportbundle) (medium, CVSS 6.4, published 17 Jul 2026) - [CVE-2026-45162: Pimcore PHP object injection in multiple components](https://junglewise.ai/threats/cve-2026-45162-pimcore-php-object-injection-in-multiple-components) (high, CVSS 8, published 17 Jul 2026) - [CVE-2026-11407: Pimcore CMS/DXP Twig sandbox bypass in SecurityPolicy](https://junglewise.ai/threats/cve-2026-11407-pimcore-cms-dxp-twig-sandbox-bypass-in-securitypolicy) (high, CVSS 7.2, published 17 Jun 2026) - [CVE-2026-5394: Pimcore Platform SQL injection in DataObject composite index handling](https://junglewise.ai/threats/cve-2026-5394-pimcore-platform-sql-injection-in-dataobject-composite-index) (high, CVSS 4, published 28 May 2026) - [Pimcore SQL injection in DataObject composite index handling](https://junglewise.ai/threats/pimcore-sql-injection-in-dataobject-composite-index-handling-6e57fdb6) (high, CVSS 7, published 27 Apr 2026) - [CVE-2026-5362: Pimcore stored XSS in Document embed editable](https://junglewise.ai/threats/cve-2026-5362-pimcore-stored-xss-in-document-embed-editable) (medium, CVSS 5.4, published 27 Apr 2026) - [CVE-2026-27461: Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause](https://junglewise.ai/threats/cve-2026-27461-pimcore-vulnerable-to-sql-injection-via-unsanitized-filter-value) (medium, CVSS 4, published 24 Feb 2026) - [CVE-2026-23494: Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing](https://junglewise.ai/threats/cve-2026-23494-pimcore-is-vulnerable-to-broken-access-control-missing-function) (low, CVSS 3.1, published 15 Jan 2026) - [CVE-2026-23493: Pimcore ENV Variables and Cookie Informations are exposed in http_error_log](https://junglewise.ai/threats/cve-2026-23493-pimcore-env-variables-and-cookie-informations-are-exposed-in-http) (low, CVSS 3.1, published 15 Jan 2026) - [CVE-2026-23492: Pimcore Has an Incomplete Patch for](https://junglewise.ai/threats/cve-2026-23492-pimcore-has-an-incomplete-patch-for) (low, CVSS 3.1, published 14 Jan 2026) - [CVE-2025-27617: Pimcore Vulnerable to SQL Injection in getRelationFilterCondition](https://junglewise.ai/threats/cve-2025-27617-pimcore-vulnerable-to-sql-injection-in-getrelationfiltercondition) (medium, CVSS 4, published 11 Mar 2025) - [CVE-2024-11954: Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document](https://junglewise.ai/threats/cve-2024-11954-pimcore-authenticated-stored-cross-site-scripting-xss-via-search) (low, CVSS 3.1, published 28 Jan 2025) - [Duplicate Advisory: Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document](https://junglewise.ai/threats/duplicate-advisory-pimcore-authenticated-stored-cross-site-scripting-f1c4aa07) (low, CVSS 3.1, published 28 Jan 2025) - [Pimcore includes vulnerable PHPOffice/PhpSpreadsheet](https://junglewise.ai/threats/pimcore-includes-vulnerable-phpoffice-phpspreadsheet-5f62ad89) (low, CVSS 3.1, published 3 Sep 2024) - [CVE-2024-32871: Flooding Server with Thumbnail files](https://junglewise.ai/threats/cve-2024-32871-flooding-server-with-thumbnail-files) (low, CVSS 3.1, published 4 Jun 2024) - [Pimcore TinyMCE Bundle - tinymce](https://junglewise.ai/threats/pimcore-tinymce-bundle-tinymce-66c5526c) (low, CVSS 3.1, published 24 Apr 2024) - [CVE-2023-47637: Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()](https://junglewise.ai/threats/cve-2023-47637-pimcore-sql-injection-in-admin-grid-filter-api-through) (low, CVSS 3.1, published 15 Nov 2023) - [CVE-2023-5873: Pimcore Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2023-5873-pimcore-cross-site-scripting-vulnerability) (low, CVSS 3.1, published 31 Oct 2023) ## Most severe pimcore/pimcore (Packagist) vulnerabilities - [CVE-2026-55634: Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code) (critical, CVSS 9.9, published 28 Aug 2026) - [CVE-2026-55220: Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization) (critical, CVSS 4, published 28 Aug 2026) - [CVE-2026-55416: Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration) (high, CVSS 8.8, published 14 Sep 2026) - [CVE-2026-44739: Pimcore SQL injection in CustomReportsBundle columnConfigAction](https://junglewise.ai/threats/cve-2026-44739-pimcore-sql-injection-in-customreportsbundle-columnconfigaction) (high, CVSS 8.7, published 17 Jul 2026) - [CVE-2026-55072: Pimcore ClassDefinition UID regex SQL injection in Block.php](https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php) (high, CVSS 8.5, published 14 Sep 2026) - [CVE-2026-45260: Pimcore missing authorization in WebDAV MOVE operation](https://junglewise.ai/threats/cve-2026-45260-pimcore-missing-authorization-in-webdav-move-operation) (high, CVSS 8.1, published 17 Jul 2026) - [CVE-2026-45162: Pimcore PHP object injection in multiple components](https://junglewise.ai/threats/cve-2026-45162-pimcore-php-object-injection-in-multiple-components) (high, CVSS 8, published 17 Jul 2026) - [CVE-2026-11407: Pimcore CMS/DXP Twig sandbox bypass in SecurityPolicy](https://junglewise.ai/threats/cve-2026-11407-pimcore-cms-dxp-twig-sandbox-bypass-in-securitypolicy) (high, CVSS 7.2, published 17 Jun 2026) - [Pimcore SQL injection in DataObject composite index handling](https://junglewise.ai/threats/pimcore-sql-injection-in-dataobject-composite-index-handling-6e57fdb6) (high, CVSS 7, published 27 Apr 2026) - [CVE-2026-5394: Pimcore Platform SQL injection in DataObject composite index handling](https://junglewise.ai/threats/cve-2026-5394-pimcore-platform-sql-injection-in-dataobject-composite-index) (high, CVSS 4, published 28 May 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 2 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 2 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities - [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq): 119 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pimcore/pimcore (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/pimcore-pimcore, 9 November 2026.