Path traversal in pimcore

MEDIUM 6.5CVE-2022-0665 · GHSA-gjq4-69wj-p6pr · Published 22/02/2022 · updated 17/06/2026

In short

CVE-2022-0665 is a MEDIUM (CVSS 6.5) vulnerability affecting pimcore/pimcore, pimcore (pimcore).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.4% of all vulnerabilities.
Fix: update to 10.3.2 or later.

Package	Affected versions	Patched versions
pimcore/pimcore Packagist	`< 10.3.2`	`10.3.2`
pimcore pimcore	`< 10.3.2`	`10.3.2`

Description

The application doesn't perform a check/filter against the value of "importFile" parameter at endpoint "/admin/translation/import". After the API is executed, PHP unlink function will proceed to delete the file.

NVD description

Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.

References

nvd.nist.gov/vuln/detail/CVE-2022-0665 · ADVISORY
pimcore/pimcore commit 2894564 · WEB
pimcore/pimcore · PACKAGE
huntr.dev/bounties/423df64d-c591-4ad9-bf1c-411bcbc06ba3 · WEB

More vulnerabilities in pimcore/pimcore

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pimcore/pimcore

Packagist

< 10.3.2

10.3.2

pimcore

< 10.3.2

10.3.2

More vulnerabilities in pimcore/pimcore

See all →