Technical impact
The vulnerability arises from empty implementations of checkMethodAllowed() and checkPropertyAllowed() in the custom Twig SecurityPolicy of Pimcore CMS/DXP version 12.3.8. Authenticated administrators can inject malicious Twig templates through the DataObject ClassDefinition Layout\Text component. This bypass permits execution of arbitrary PHP object methods, enabling actions such as arbitrary file reads, arbitrary database queries, and potentially remote code execution via PHP object gadget chains. The loophole also extends to all Pimcore Twig functions through the pimcore_* function wildcard.
Affected Systems
The affected product is Pimcore CMS/DXP version 12.3.8, released by Pimcore GmbH. No other versions are noted as vulnerable. Deployments running this version where admins can create or edit DataObject ClassDefinitions are at risk.
Risk and Exploitability
The CVSS score of 8.6 denotes high severity, yet the EPSS score is below 1%, indicating a low probability of exploitation at the time of disclosure. The vulnerability is not listed in the CISA KEV catalogue. Successful exploitation requires authenticated administrative privileges and the ability to submit a Twig template through the web interface. Consequently, the risk remains significant for organizations that cannot apply the fix promptly.
Github GHSA