CVE-2021-39166: Pimcore

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.

Affected products

• Pimcore Pimcore: before 10.1.2 (fixed in 10.1.2)

Published 2021-09-01. Last modified 2026-06-17.