CVE-2026-45703: Pimcore

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

Affected products

• Pimcore Pimcore: before 11.5.17 (fixed in 11.5.17); from 12.0.0, before 12.3.7 (fixed in 12.3.7)

Published 2026-07-17. Last modified 2026-07-22.