Stored Cross-Site Scripting Vulnerability in Pimcore by Pimcore
CVE-2026-109392

5.1MEDIUM

Key Information:

Vendor

Pimcore
Status
Pimcore
Vendor
CVE Published:
12 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109392?

Pimcore versions up to 2026.3.1 are susceptible to a stored cross-site scripting (XSS) vulnerability. Authenticated backend users with data object edit permissions can exploit the ExternalImage fields by injecting unescaped URLs containing malicious scripts. This occurs when these scripts are rendered in the admin interface, specifically during the version preview or diff view processes, potentially compromising other users when viewing shared content. The exploitation represents a significant risk as it can enable attackers to execute arbitrary JavaScript within the context of the admin session.

Affected Version(s)

Pimcore 0 <= 2026.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109392 - Proof of Concept

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJCbgCKjMe
technical-descriptionexploit
https://github.com/pimcore/pimcore/blob/v2026.3.1/models/...
technical-description
https://github.com/pimcore/admin-ui-classic-bundle/blob/2...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.