Is pimcore/pimcore 12.0 vulnerable?
Composer · 5 releases from 12.0.0 to 12.0.4 · latest pimcore/pimcore is 2026.3.3.1 · checked 1 Nov 2026
Yes: 15 known advisories
Yes. pimcore/pimcore 12.0.4, the last 12.0 release, is affected by 15 known security advisories (2 critical, 10 high, 3 medium), including CVE-2026-55634, CVE-2026-55220, CVE-2026-55416. At least one has no fixed release yet.
Advisories affecting pimcore/pimcore 12.0.4
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
- Affected
- >=2026.1.0 <2026.1.6 · >=12.0.0-RC1 <12.3.10 · <11.5.19
- Fixed in
- 11.5.19, 12.3.10, 2026.1.6
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
- Affected
- <12.3.10 · >=2026.1.0 <2026.1.6
- Fixed in
- 12.3.10, 2026.1.6
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
- Affected
- >=2026.1.0 <2026.1.6 · <12.3.10
- Fixed in
- 12.3.10, 2026.1.6
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
- Affected
- >=2026.1.0 <2026.1.5 · <12.3.9
- Fixed in
- 12.3.9, 2026.1.5
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
- Affected
- >=12.0.0-RC1 <=12.3.8 · <=11.5.14.1
- Fixed in
- No fix released
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has a CustomReports Share Bypass
- Affected
- >=12.0.0-RC1 <12.3.6 · <11.5.17 · >=2026.1.0 <2026.1.2
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
- Affected
- >=12.0.0-RC1 <12.3.7 · >=2026.1.0 <2026.1.3 · <11.5.17
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
- Affected
- >=2026.1.0 <2026.1.2 · <11.5.17 · >=12.0.0-RC1 <12.3.6
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
- Affected
- <=11.5.14.1 · >=12.0.0 <12.3.3
- Fixed in
- 12.3.3
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Pimcore Has an Incomplete Patch for CVE-2023-30848
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Which of your client projects are still on pimcore/pimcore 12.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact pimcore/pimcore version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other pimcore/pimcore versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.