# Pimcore vulnerabilities Source: https://junglewise.ai/threats/vendors/pimcore Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/pimcore.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Pimcore: 0 in the last 7 days and 5 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-109392, was published on 12 October 2026. 1 vulnerability in the last four weeks, down 50% on the four before (2). 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 5 - All time: 19 (2 critical, 0 exploited in the wild) ## About Pimcore Pimcore is a software vendor specializing in open-source data management and customer experience software. ## Latest Pimcore vulnerabilities - [CVE-2026-109392: Pimcore stored cross-site scripting in data objects](https://junglewise.ai/threats/cve-2026-109392-pimcore-through-2026-3-1-contains-a-stored-cross-site-scripting) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-55416: Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration) (high, CVSS 8.8, published 14 Sep 2026) - [CVE-2026-55072: Pimcore ClassDefinition UID regex SQL injection in Block.php](https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php) (high, CVSS 8.5, published 14 Sep 2026) - [CVE-2026-55634: Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code) (critical, CVSS 9.9, published 28 Aug 2026) - [CVE-2026-55220: Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization) (critical, CVSS 4, published 28 Aug 2026) - [CVE-2026-72562: Pimcore admin-ui-classic-bundle SQL injection in DataObject grid filter](https://junglewise.ai/threats/cve-2026-72562-pimcore-admin-ui-classic-bundle-sql-injection-in-dataobject-grid) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-45704: Pimcore CustomReports authorization bypass in report detail endpoint](https://junglewise.ai/threats/cve-2026-45704-pimcore-customreports-authorization-bypass-in-report-detail) (high, CVSS 4, published 17 Jul 2026) - [CVE-2026-45260: Pimcore missing authorization in WebDAV MOVE operation](https://junglewise.ai/threats/cve-2026-45260-pimcore-missing-authorization-in-webdav-move-operation) (high, CVSS 8.1, published 17 Jul 2026) - [CVE-2026-44739: Pimcore SQL injection in CustomReportsBundle columnConfigAction](https://junglewise.ai/threats/cve-2026-44739-pimcore-sql-injection-in-customreportsbundle-columnconfigaction) (high, CVSS 8.7, published 17 Jul 2026) - [CVE-2026-45703: Pimcore missing authorization in WordExportBundle](https://junglewise.ai/threats/cve-2026-45703-pimcore-missing-authorization-in-wordexportbundle) (medium, CVSS 6.4, published 17 Jul 2026) - [CVE-2026-45162: Pimcore PHP object injection in multiple components](https://junglewise.ai/threats/cve-2026-45162-pimcore-php-object-injection-in-multiple-components) (high, CVSS 8, published 17 Jul 2026) - [CVE-2026-55212: Pimcore Studio API privilege escalation in class definition creation](https://junglewise.ai/threats/cve-2026-55212-pimcore-studio-api-privilege-escalation-in-class-definition) (high, CVSS 7.1, published 9 Jul 2026) - [CVE-2026-55208: Pimcore Studio Backend Bundle SQL injection in DateFilter](https://junglewise.ai/threats/cve-2026-55208-pimcore-studio-backend-bundle-sql-injection-in-datefilter) (high, CVSS 7.7, published 9 Jul 2026) - [CVE-2026-55207: Pimcore studio-backend-bundle account takeover via password reset URL injection](https://junglewise.ai/threats/cve-2026-55207-pimcore-studio-backend-bundle-account-takeover-via-password-reset) (high, CVSS 8.8, published 9 Jul 2026) - [CVE-2026-11407: Pimcore CMS/DXP Twig sandbox bypass in SecurityPolicy](https://junglewise.ai/threats/cve-2026-11407-pimcore-cms-dxp-twig-sandbox-bypass-in-securitypolicy) (high, CVSS 7.2, published 17 Jun 2026) - [CVE-2026-5394: Pimcore Platform SQL injection in DataObject composite index handling](https://junglewise.ai/threats/cve-2026-5394-pimcore-platform-sql-injection-in-dataobject-composite-index) (high, CVSS 4, published 28 May 2026) - [CVE-2026-44741: Pimcore Admin Classic Bundle SQL injection in translation grid date filter](https://junglewise.ai/threats/cve-2026-44741-pimcore-admin-classic-bundle-sql-injection-in-translation-grid) (high, CVSS 8.8, published 27 May 2026) - [Pimcore SQL injection in DataObject composite index handling](https://junglewise.ai/threats/pimcore-sql-injection-in-dataobject-composite-index-handling-6e57fdb6) (high, CVSS 7, published 27 Apr 2026) - [CVE-2026-5362: Pimcore stored XSS in Document embed editable](https://junglewise.ai/threats/cve-2026-5362-pimcore-stored-xss-in-document-embed-editable) (medium, CVSS 5.4, published 27 Apr 2026) ## Most severe Pimcore vulnerabilities - [CVE-2026-55634: Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code) (critical, CVSS 9.9, published 28 Aug 2026) - [CVE-2026-55220: Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization) (critical, CVSS 4, published 28 Aug 2026) - [CVE-2026-55207: Pimcore studio-backend-bundle account takeover via password reset URL injection](https://junglewise.ai/threats/cve-2026-55207-pimcore-studio-backend-bundle-account-takeover-via-password-reset) (high, CVSS 8.8, published 9 Jul 2026) - [CVE-2026-55416: Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration) (high, CVSS 8.8, published 14 Sep 2026) - [CVE-2026-44741: Pimcore Admin Classic Bundle SQL injection in translation grid date filter](https://junglewise.ai/threats/cve-2026-44741-pimcore-admin-classic-bundle-sql-injection-in-translation-grid) (high, CVSS 8.8, published 27 May 2026) - [CVE-2026-72562: Pimcore admin-ui-classic-bundle SQL injection in DataObject grid filter](https://junglewise.ai/threats/cve-2026-72562-pimcore-admin-ui-classic-bundle-sql-injection-in-dataobject-grid) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-44739: Pimcore SQL injection in CustomReportsBundle columnConfigAction](https://junglewise.ai/threats/cve-2026-44739-pimcore-sql-injection-in-customreportsbundle-columnconfigaction) (high, CVSS 8.7, published 17 Jul 2026) - [CVE-2026-55072: Pimcore ClassDefinition UID regex SQL injection in Block.php](https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php) (high, CVSS 8.5, published 14 Sep 2026) - [CVE-2026-45260: Pimcore missing authorization in WebDAV MOVE operation](https://junglewise.ai/threats/cve-2026-45260-pimcore-missing-authorization-in-webdav-move-operation) (high, CVSS 8.1, published 17 Jul 2026) - [CVE-2026-45162: Pimcore PHP object injection in multiple components](https://junglewise.ai/threats/cve-2026-45162-pimcore-php-object-injection-in-multiple-components) (high, CVSS 8, published 17 Jul 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 50% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 2 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Pimcore technologies - [Pimcore](https://junglewise.ai/threats/technologies/pimcore): 16 vulnerabilities - [Pimcore Admin UI Classic Bundle](https://junglewise.ai/threats/technologies/admin-ui-classic-bundle): 3 vulnerabilities - [Pimcore Studio Backend Bundle](https://junglewise.ai/threats/technologies/studio-backend-bundle): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Pimcore vulnerabilities", https://junglewise.ai/threats/vendors/pimcore, 12 November 2026.