CVE-2026-23493

MEDIUM EPSS 31.1%
Published Jan 15, 20265mo ago · Modified Jun 17, 20262w ago
4.9 CVSS 3.1
Medium
Find Similar
Published Jan 15, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.

CVSS Details

Base Score
4.9
Exploitability
1.2
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
31.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-532

Affected Products 2

VendorProductVersionRange
pimcorepimcore* <11.5.14
pimcorepimcore*≥12.0.0  –  <12.3.1

References 5

  • github.com https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
    Patch
  • github.com https://github.com/pimcore/pimcore/pull/18918
    Issue Tracking
  • github.com https://github.com/pimcore/pimcore/releases/tag/v11.5.14
    Release Notes
  • github.com https://github.com/pimcore/pimcore/releases/tag/v12.3.1
    Release Notes
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
    Vendor Advisory

Remediation

  • github.com https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
    Patch