{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"12.0.0-RC1","last_affected":"12.3.8"},{"introduced":"0","last_affected":"11.5.14.1"}],"component":"pimcore/pimcore","cve_ids":["CVE-2026-11407"],"ecosystem":"Packagist","epss":0.00623,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7p36-fq2r-4h7r","id":"tcs_01M5KEY8NSVQ2BDMFR22C27EFW","modified_at":"2026-09-02T16:15:07.634914346Z","published_at":"2026-06-17T21:34:38Z","references":["https://osv.dev/vulnerability/GHSA-7p36-fq2r-4h7r","https://nvd.nist.gov/vuln/detail/CVE-2026-11407","https://github.com/pimcore/pimcore/pull/19193","https://github.com/pimcore/pimcore/commit/fffa7f6396329e88610db70a8652529bbc734892","https://github.com/pimcore/pimcore","https://www.vulncheck.com/advisories/pimcore-cms-twig-sandbox-bypass-via-securitypolicy-checkmethodallowed"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-7p36-fq2r-4h7r","url":"https://osv.dev/vulnerability/GHSA-7p36-fq2r-4h7r"}],"summary":"Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed"}