CVE-2026-11407
1 advisory.
Packagist/pimcore/pimcore CVE-2026-11407: high 7.2
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.0.0-RC1 | - | 12.3.8 |
| 0 | - | 11.5.14.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-7p36-fq2r-4h7r
- https://nvd.nist.gov/vuln/detail/CVE-2026-11407
- https://github.com/pimcore/pimcore/pull/19193
- https://github.com/pimcore/pimcore/commit/fffa7f6396329e88610db70a8652529bbc734892
- https://github.com/pimcore/pimcore
- https://www.vulncheck.com/advisories/pimcore-cms-twig-sandbox-bypass-via-securitypolicy-checkmethodallowed
CVE-2026-11407 · published · modified · JSON