CVE-2026-45162 HIGH

CVE-2026-45162: Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

Vendor Pimcore
Product pimcore
Weakness CWE-502 · Unsafe deserialization
Published July 17, 2026
Last update July 17, 2026
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

Key dates

02Disclosure timeline

July 17, 2026 CVE published
July 17, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability CVE-2026-12115 Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import CVE-2026-57770 WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability CVE-2026-65581 WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability CVE-2026-57724 WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability