PT-2026-50531 · Pimcore · Pimcore Cms/Dxp

Saidakbarxon Maxsudxonov · CVE-2026-11407 · Published 2026-06-17 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pimcore CMS/DXP version 12.3.8

Description A sandbox bypass allows authenticated administrative attackers to execute arbitrary methods on PHP objects. This occurs due to empty checkMethodAllowed() and checkPropertyAllowed() implementations within the custom Twig SecurityPolicy. By supplying malicious Twig templates through the 'DataObject ClassDefinition LayoutText' component, attackers can perform arbitrary file reads and execute arbitrary database queries. Furthermore, the pimcore * function wildcard extends the bypass to all Pimcore Twig functions, potentially leading to remote code execution via PHP object gadget chains.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-11407

GHSA-7P36-FQ2R-4H7R

Affected Products

Pimcore Cms/Dxp

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11407.json · Exploit
• https://github.com/pimcore/pimcore/commit/fffa7f6396329e88610db70a8652529bbc734892 · Patch
• https://osv.dev/vulnerability/GHSA-7p36-fq2r-4h7r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-11407 · Security Note
• https://osv.dev/vulnerability/CVE-2026-11407 · Vendor Advisory
• https://github.com/pimcore/pimcore/pull/19193 · Note
• https://github.com/pimcore/pimcore · Note
• https://twitter.com/CVEnew/status/2067350967922626909 · Twitter Post
• https://t.me/CVEtracker/57164 · Telegram Post
• https://vulncheck.com/advisories/pimcore-cms-twig-sandbox-bypass-via-securitypolicy-checkmethodallowed · Note