CVE-2014-2922: Pimcore

Medium severity, CVSS 6.4. EPSS: 2.8% chance of exploitation in the next 30 days.

The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.

Affected products

• Pimcore Pimcore: version 1.4.9 only; version 1.5.0 only; version 2.1.0 only

Published 2014-04-21. Last modified 2026-06-17.