Sandbox Bypass Vulnerability in Pimcore CMS/DXP by Pimcore

CVE-2026-11407

What is CVE-2026-11407?

A vulnerability in Pimcore CMS/DXP version 12.3.8 allows authenticated administrative users to bypass the sandboxing mechanisms intended to secure PHP object manipulation. By exploiting faulty implementations of the checkMethodAllowed() and checkPropertyAllowed() functions within the custom Twig SecurityPolicy, attackers can inject malicious Twig templates. This manipulation can lead to unauthorized file reads and the ability to execute arbitrary database queries. The vulnerability is further exacerbated by the usage of pimcore_* function wildcards, which gives attackers broader access to all Pimcore Twig functions, potentially leading to remote code execution through crafted PHP object gadget chains.

References