Is pimcore/pimcore 11.1 vulnerable?
Composer · 7 releases from 11.1.0 to 11.1.6 · latest pimcore/pimcore is 2026.3.3.1 · checked 1 Nov 2026
Yes: 17 known advisories
Yes. pimcore/pimcore 11.1.6, the last 11.1 release, is affected by 17 known security advisories (2 critical, 11 high, 4 medium), including CVE-2026-55634, CVE-2026-55220, CVE-2026-55416. 3 more affect earlier 11.1.x releases. At least one has no fixed release yet.
Advisories affecting pimcore/pimcore 11.1.6
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
- Affected
- >=2026.1.0 <2026.1.6 · >=12.0.0-RC1 <12.3.10 · <11.5.19
- Fixed in
- 11.5.19, 12.3.10, 2026.1.6
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
- Affected
- <12.3.10 · >=2026.1.0 <2026.1.6
- Fixed in
- 12.3.10, 2026.1.6
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
- Affected
- >=2026.1.0 <2026.1.6 · <12.3.10
- Fixed in
- 12.3.10, 2026.1.6
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
- Affected
- >=2026.1.0 <2026.1.5 · <12.3.9
- Fixed in
- 12.3.9, 2026.1.5
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
- Affected
- >=12.0.0-RC1 <=12.3.8 · <=11.5.14.1
- Fixed in
- No fix released
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has a CustomReports Share Bypass
- Affected
- >=12.0.0-RC1 <12.3.6 · <11.5.17 · >=2026.1.0 <2026.1.2
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
- Affected
- >=12.0.0-RC1 <12.3.7 · >=2026.1.0 <2026.1.3 · <11.5.17
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
- Affected
- >=2026.1.0 <2026.1.2 · <11.5.17 · >=12.0.0-RC1 <12.3.6
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
- Affected
- <=11.5.14.1 · >=12.0.0 <12.3.3
- Fixed in
- 12.3.3
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Pimcore Has an Incomplete Patch for CVE-2023-30848
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
- Affected
- <11.5.4
- Fixed in
- 11.5.4
Flooding Server with Thumbnail files
- Affected
- >=11.0.0 <11.2.4
- Fixed in
- 11.2.4
Fixed within 11.1.x, affecting earlier releases
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
- Affected
- >=10.6.9.0 <10.6.9.12 · >=11.1.0.0 <11.1.6.11
- Fixed in
- 10.6.9.12, 11.1.6.11
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
- Affected
- >=11.2.0 <11.2.3 · >=11.0.0-ALPHA1 <11.1.6.5
- Fixed in
- 11.1.6.5, 11.2.3
Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()
- Affected
- <11.1.1
- Fixed in
- 11.1.1
Which of your client projects are still on pimcore/pimcore 11.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact pimcore/pimcore version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other pimcore/pimcore versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.