Pimcore Unserialize Remote Code Execution

HIGH 8.8CVE-2019-10867 · GHSA-7hqr-j26m-gmwp · SNYK-PHP-PIMCOREPIMCORE-173998 · Published 04/04/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
pimcore/pimcore Packagist	`< 5.7.1`	`5.7.1`
pimcore pimcore	`< 5.7.1`	`5.7.1`

Description

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

NVD description

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

References

nvd.nist.gov/vuln/detail/CVE-2019-10867 · ADVISORY
pimcore/pimcore commit 38a29e2 · WEB
blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce · WEB
pimcore/pimcore · PACKAGE
snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998 · WEB
exploit-db.com/exploits/46783 · WEB
packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html · WEB
rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce · WEB
exploit-db.com/exploits/46783 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pimcore/pimcore

Packagist

< 5.7.1

5.7.1

pimcore

< 5.7.1

5.7.1

Description

NVD description