CVE-2026-45162

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.17 (LTS) Pimcore versions prior to 12.3.7

Description Multiple locations in the software call the PHP unserialize() function on data retrieved from database columns and filesystem files without using the allowed classes restriction. This allows any class available in the autoloader to be instantiated during deserialization. If an attacker can control the serialized data source, they can perform object injection, potentially leading to remote code execution by injecting serialized PHP gadget chains. The affected files include lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php.

Recommendations Update to version 11.5.17 (LTS). Update to version 12.3.7. As a temporary mitigation, restrict write access to the database tables tmp store, sites, and custom layouts, as well as the WebDAV delete log files, to prevent the injection of malicious serialized data.