The vulnerability exposes Pimcore installations prior to version 11.5.17 (LTS) and 12.3.7 to an unsafe deserialization flaw. Multiple code paths, including lib/Tool/Authentication.php, models/Site/Dao.php, and others, invoke PHP's unserialize() on data from database columns or filesystem files without using the allowed_classes restriction. When an attacker can control the content of the serialized data, object injection occurs, enabling remote code execution.

Pimcore Open Source Data & Experience Management Platform, versions prior to 11.5.17 (LTS) and 12.3.7 are vulnerable. All affected installations before these releases must be considered at risk.

The CVSS score of 8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to control the content of the serialized data source, implying that threat actors would need either local database access or a way to influence files that are deserialized by the application. This condition makes the attack vector more limited, but if the conditions are met, the impact could be complete compromise of the affected system.