CVE-2026-23959: Coreshop

Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days.

CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. Version 4.1.9 fixes the issue.

Affected products

• Coreshop Coreshop: before 4.1.9 (fixed in 4.1.9)

Published 2026-01-22. Last modified 2026-06-17.