CVE-2026-55220

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.19 Pimcore versions prior to 12.3.10 Pimcore versions prior to 2026.1.6

Description Pimcore is an Open Source Data & Experience Management Platform. The getDataFromResource() function in PimcoreModelDataObjectClassDefinitionDataHotspotimage passes the hotspots object-store column to the PimcoreToolSerialize::unserialize() function without an allowed-classes restriction after JSON decoding fails. This occurs because the unserialize() wrapper defaults to allowing all classes.

An attacker who can write crafted PHP serialized bytes into the hotspots column can trigger PHP Object Injection. This allows the instantiation of available classes and the execution of magic methods (such as wakeup or destruct) when an affected DataObject is loaded. This can lead to arbitrary file writes or remote code execution through bundled gadget chains, such as those found in guzzlehttp/guzzle. The same issue affects the ImageGallery, Block, and Video marshallers, which use the same fallback pattern.

Recommendations Update to version 11.5.19 or later. Update to version 12.3.10 or later. Update to version 2026.1.6 or later. As a temporary mitigation, restrict access to the hotspots object-store column to prevent unauthorized writes of serialized data.