An authenticated attacker that can edit document content is able to embed arbitrary HTML or JavaScript into a document’s editable embed section. When a user later views the published page, the injected code runs in the browser and executes with the page’s privileges, potentially enabling data theft, session hijacking or other client‑side attacks.

Pimcore Platform version 12.3.3 is affected. The vulnerability exists on all operating systems supported by that release – Linux, macOS, and Windows – as indicated by the CPE entries for the platform.

The CVSS score of 4.8 marks the issue as moderate severity; however, because the attack requires authenticated access with editing rights, the likelihood of exploitation depends on insider threat or compromised credentials. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. Even so, an internal actor could use the flaw to inject malicious scripts that execute for every visitor of the affected page.