Is pimcore/pimcore 12.3 vulnerable?
Composer · 13 releases from 12.3.0 to 12.3.12 · latest pimcore/pimcore is 2026.3.3.1 · checked 1 Nov 2026
No known advisories in the last release
pimcore/pimcore 12.3.12, the last 12.3 release, has no known advisories. 16 advisories affect earlier 12.3.x releases, so update to 12.3.12.
composer require pimcore/pimcore:^12.3.12Fixed within 12.3.x, affecting earlier releases
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
- Affected
- >=2026.1.0 <2026.1.6 · >=12.0.0-RC1 <12.3.10 · <11.5.19
- Fixed in
- 11.5.19, 12.3.10, 2026.1.6
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
- Affected
- <12.3.10 · >=2026.1.0 <2026.1.6
- Fixed in
- 12.3.10, 2026.1.6
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
- Affected
- >=2026.1.0 <2026.1.6 · <12.3.10
- Fixed in
- 12.3.10, 2026.1.6
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
- Affected
- >=2026.1.0 <2026.1.5 · <12.3.9
- Fixed in
- 12.3.9, 2026.1.5
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
- Affected
- >=12.0.0-RC1 <=12.3.8 · <=11.5.14.1
- Fixed in
- No fix released
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has a CustomReports Share Bypass
- Affected
- >=12.0.0-RC1 <12.3.6 · <11.5.17 · >=2026.1.0 <2026.1.2
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
- Affected
- >=12.0.0-RC1 <12.3.7 · >=2026.1.0 <2026.1.3 · <11.5.17
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
- Affected
- >=2026.1.0 <2026.1.2 · <11.5.17 · >=12.0.0-RC1 <12.3.6
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Pimcore has an authenticated Cross-site Scripting issue
- Affected
- 12.3.3
- Fixed in
- No fix released
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
- Affected
- <=11.5.14.1 · >=12.0.0 <12.3.3
- Fixed in
- 12.3.3
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Pimcore Has an Incomplete Patch for CVE-2023-30848
- Affected
- >=12.0.0-RC1 <12.3.1 · <11.5.14
- Fixed in
- 11.5.14, 12.3.1
Which of your client projects are still on pimcore/pimcore 12.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact pimcore/pimcore version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other pimcore/pimcore versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.