CVE-2026-45162: Pimcore

High severity, CVSS 8.0. EPSS: 1% chance of exploitation in the next 30 days.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

Affected products

• Pimcore Pimcore: before 11.5.17 (fixed in 11.5.17); from 12.0.0, before 12.3.7 (fixed in 12.3.7)

Published 2026-07-17. Last modified 2026-07-22.