Cross-site Scripting in Pimcore

MEDIUM 5.4CVE-2022-0832 · GHSA-6qcc-whgp-pjj2 · Published 04/03/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
pimcore/pimcore Packagist	`< 10.3.3`	`10.3.3`
pimcore pimcore	`< 10.3.3`	`10.3.3`

Description

Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.

NVD description

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.