PT-2026-35518 · Pimcore · Pimcore

Oscar Naveda · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-5394

X.com · Fluidattacks

CVSS v4.0

7.0

High

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

🚨 New zero-day in Pimcore | Detected by our AI SAST scanner and disclosed by Oscar Naveda. As a #CNA, we assigned the ID CVE-2026-5394. Details: 🔗 https://t.co/BoVhbbIJaq. We have announced 233 #CVEs to this date: 🔗 https://t.co/fgMrQcyKAU https://t.co/nAD8eL0pPf

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-5394

Affected Products

Pimcore

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-5394 · Security Note
• https://github.com/pimcore/pimcore · Note
• https://twitter.com/fluidattacks/status/2049255336864092425 · Twitter Post
• https://fluidattacks.com/es/advisories/dragons · Note
• https://twitter.com/VulmonFeeds/status/2048922040141238733 · Twitter Post