CVE-2026-23493highCWE-532

CVE-2026-23493: high-severity vulnerability in pimcore

Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.4%
exploitation probability
0.4%top 64% of all CVEs
observed exploitation
nono source reports it
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected products
pimcore · pimcore
Related CVEs — pimcore

In the same product, most dangerous first.

CVE-2022-39365CRITICALRCE vulnerability in Pimcore/Mail & Dynamic Text LayoutEPSS 1.8%CVE-2022-31092HIGHSQL injection in pimcoreEPSS 1.4%CVE-2021-39189MEDIUMObservable Response Discrepancy in Lost Password ServiceEPSS 1.4%CVE-2021-39170HIGHImproper Encoding or Escaping of Output in Asset Metadata ComponentEPSS 1.2%CVE-2023-47637HIGHSQL Injection in Admin Grid Filter API in PimcoreEPSS 1.2%CVE-2021-37702HIGHImproper Neutralization of Formula Elements in a CSV File in pimcore/pimcoreEPSS 1.1%
References
https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601https://github.com/pimcore/pimcore/pull/18918https://github.com/pimcore/pimcore/releases/tag/v11.5.14https://github.com/pimcore/pimcore/releases/tag/v12.3.1https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h