PT-2026-3074 · Pimcore · Pimcore

Putzflorian · Published 2026-01-15 · Updated 2026-01-20 · CVE-2026-23493

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 12.3.1 Pimcore versions prior to 11.5.14

Description Pimcore is an Open Source Data & Experience Management Platform. Prior to versions 12.3.1 and 11.5.14, the http error log file stores the $ COOKIE and $ SERVER variables. This can lead to the exposure of sensitive information, including database passwords and cookie session data, accessible through the Pimcore backend.

Recommendations Versions prior to 12.3.1 should be updated to version 12.3.1 or later. Versions prior to 11.5.14 should be updated to version 11.5.14 or later.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-23493

GHSA-Q433-J342-RP9H

Affected Products

Pimcore

References · 14

• 🔥 https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23493.json · Exploit
• https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601 · Patch
• https://osv.dev/vulnerability/GHSA-q433-j342-rp9h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23493 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23493 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/pull/18918 · Note
• https://github.com/pimcore/pimcore/releases/tag/v12.3.1 · Note
• https://github.com/pimcore/pimcore/releases/tag/v11.5.14 · Note
• https://twitter.com/CVEnew/status/2011926079515345383 · Twitter Post
• https://twitter.com/CveFindCom/status/2011855684778840326 · Twitter Post
• https://t.me/cveNotify/149347 · Telegram Post
• https://twitter.com/TheHackerWire/status/2011856373659942966 · Twitter Post