Pimcore · Pimcore Admin Classic Bundle · CVE-2023-47636
**Name of the Vulnerable Software and Affected Versions**
Pimcore Admin Classic Bundle versions prior to 1.2.1
**Description**
The issue allows an attacker to see the path to the webroot/file, which can be used in conjunction with other vulnerabilities, such as SQL Injection using the `load file()` query, to view the page source. In the case of Pimcore, the `fopen()` function does not have an error handle when the file does not exist on the server, causing the server response to reveal the full path, for example, "fopen(/var/www/html/var/tmp/export-{unique id}.csv)".
**Recommendations**
For Pimcore Admin Classic Bundle versions prior to 1.2.1, upgrade to version 1.2.1 to resolve the issue. There are no known workarounds for this vulnerability.