Pimcore’s Hotspotimage data importer calls a generic unserialization routine without restricting which classes can be instantiated. An attacker who can inject crafted PHP serialized bytes into the __hotspots object‑store column can trigger PHP magic methods through gadget chains, leading to arbitrary file writes or execution of arbitrary code. This flaw directly enables remote code execution if an attacker can write to that column, as the vulnerability is not mitigated by validation or permissions at the application layer.

The vulnerability exists in Pimcore’s open‑source Data & Experience Management Platform prior to version 11.5.19, 12.3.10, and 2026.1.6. All earlier releases of the Pimcore platform that use the affected Hotspotimage class are impacted, including earlier Major releases that do not contain the fix. The issue is addressed by the Hotspotimage caller in the fixed releases listed above.

The CVSS score of 9.3 indicates a high severity attack. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploits yet. However, the flaw requires the ability to write arbitrary serialized data into the database column, a capability typically reserved for users with curative or system access. If such access is gained, the attacker can trigger gadget chains and achieve code execution. The risk is therefore high for installations that expose write access to the __hotspots column or run under privileged database users, and moderate otherwise.