CVE-2026-55220
1 advisory.
Packagist/pimcore/pimcore CVE-2026-55220: critical
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Action: Upgrade pimcore/pimcore to 12.3.10 or later.
composer require pimcore/pimcore:2026.1.6composer require pimcore/pimcore:12.3.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 2026.1.0 | 2026.1.6 | - |
| 0 | 12.3.10 | - |
Fixed versions
| 2026.1.6 | 12.3.10 |
Sources
- osv: GHSA-w23p-wrp7-ch38
- https://github.com/pimcore/pimcore/security/advisories/GHSA-w23p-wrp7-ch38
- https://github.com/pimcore/pimcore/pull/19181
- https://github.com/pimcore/pimcore/commit/b184c01bf11e213e601d965b4e96c8bb7248e980
- https://github.com/pimcore/pimcore
- https://github.com/pimcore/pimcore/releases/tag/v12.3.10
- https://github.com/pimcore/pimcore/releases/tag/v2026.1.6
CVE-2026-55220 · published · modified · JSON