PT-2026-50531 · Pimcore Gmbh · Pimcore Cms/Dxp

Saidakbarxon Maxsudxonov · Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-11407

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore CMS/DXP version 12.3.8

Description A sandbox bypass allows authenticated administrative attackers to execute arbitrary methods on PHP objects. This occurs due to empty checkMethodAllowed() and checkPropertyAllowed() implementations within the custom Twig SecurityPolicy. By supplying malicious Twig templates through the 'DataObject ClassDefinition LayoutText' component, attackers can perform arbitrary file reads and execute arbitrary database queries. Furthermore, the pimcore * function wildcard extends the bypass to all Pimcore Twig functions, potentially leading to remote code execution via PHP object gadget chains.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-11407

Affected Products

Pimcore Cms/Dxp

References · 4

• https://github.com/pimcore/pimcore/commit/fffa7f6396329e88610db70a8652529bbc734892 · Patch
• https://github.com/pimcore/pimcore/pull/19193 · Note
• https://vulncheck.com/advisories/pimcore-cms-twig-sandbox-bypass-via-securitypolicy-checkmethodallowed · Note
• https://twitter.com/CVEnew/status/2067350967922626909 · Twitter Post