CVE-2021-39170: Pimcore

Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days.

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.

Affected products

• Pimcore Pimcore: before 10.1.2 (fixed in 10.1.2)

Published 2021-09-01. Last modified 2026-06-17.