Description
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the admin origin when other users open version preview or diff views.
Published: 2026-10-12
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting via ExternalImage field in Pimcore
Action: Apply Patch
AI Analysis

Impact

Pimcore versions up to 2026.3.1 contain a stored cross‑site scripting flaw that allows an authenticated backend user to embed malicious scripts by storing unescaped URLs in ExternalImage fields. When another user opens a version preview or diff view, the stored JavaScript is executed within the admin origin, exposing the victim to client‑side attacks.

Affected Systems

Pimcore deployments using the 2026.x series, including versions 2026.0 through and including 2026.3.1, are vulnerable if ExternalImage fields are used in editable data objects.

Risk and Exploitability

The CVSS score for this issue is 5.1, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with data object edit permissions to store a malicious payload that is subsequently rendered during a version preview or diff view. Based on the description, the script runs in the admin UI and could potentially allow session hijacking or further attacks, but the precise scope of impact is inferred rather than explicitly stated in the input data.

Generated by OpenCVE AI on October 12, 2026 at 17:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a Pimcore version newer than 2026.3.1 in which ExternalImage URLs are sanitized before rendering
  • Restrict the use of ExternalImage fields to trusted users and limit edit permissions for data objects that include this field
  • Introduce server‑side input validation to ensure URLs stored in ExternalImage fields do not contain executable script content

Generated by OpenCVE AI on October 12, 2026 at 17:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the admin origin when other users open version preview or diff views.
Title Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
First Time appeared Pimcore
Pimcore pimcore
Weaknesses CWE-79
CPEs cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
Vendors & Products Pimcore
Pimcore pimcore
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Pimcore Pimcore
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T18:22:20.725Z

Reserved: 2026-10-12T14:40:42.449Z

Link: CVE-2026-109392

cve-icon Vulnrichment

Updated: 2026-10-13T18:22:15.523Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T16:17:04.557

Modified: 2026-10-13T19:18:32.847

Link: CVE-2026-109392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T17:15:15Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')