Pimcore has an authenticated Cross-site Scripting issue

MEDIUM 5.4CVE-2026-5362 · GHSA-7gxw-q9j5-mrj4 · Published 27/04/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
pimcore/pimcore Packagist	`= 12.3.3`	No fix yet
pimcore pimcore	`= 12.3.3`	No fix yet

Description

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered.

This issue affects pimcore: v12.3.3.

NVD description

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.

References

nvd.nist.gov/vuln/detail/CVE-2026-5362 · ADVISORY
fluidattacks.com/es/advisories/mago · WEB
pimcore/pimcore · PACKAGE
pimcore/pimcore · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free