Is pimcore/pimcore 2026.1 vulnerable?
Composer · 8 releases from 2026.1.0 to 2026.1.7 · latest pimcore/pimcore is 2026.3.3.1 · checked 1 Nov 2026
No known advisories in the last release
pimcore/pimcore 2026.1.7, the last 2026.1 release, has no known advisories. 10 advisories affect earlier 2026.1.x releases, so update to 2026.1.7.
composer require pimcore/pimcore:^2026.1.7Fixed within 2026.1.x, affecting earlier releases
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
- Affected
- >=2026.1.0 <2026.1.6 · >=12.0.0-RC1 <12.3.10 · <11.5.19
- Fixed in
- 11.5.19, 12.3.10, 2026.1.6
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
- Affected
- <12.3.10 · >=2026.1.0 <2026.1.6
- Fixed in
- 12.3.10, 2026.1.6
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
- Affected
- >=2026.1.0 <2026.1.6 · <12.3.10
- Fixed in
- 12.3.10, 2026.1.6
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
- Affected
- >=2026.1.0 <2026.1.5 · <12.3.9
- Fixed in
- 12.3.9, 2026.1.5
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has a CustomReports Share Bypass
- Affected
- >=12.0.0-RC1 <12.3.6 · <11.5.17 · >=2026.1.0 <2026.1.2
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
- Affected
- >=12.0.0-RC1 <12.3.7 · >=2026.1.0 <2026.1.3 · <11.5.17
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
- Affected
- >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
- Fixed in
- 11.5.17, 12.3.7, 2026.1.3
Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
- Affected
- >=2026.1.0 <2026.1.2 · <11.5.17 · >=12.0.0-RC1 <12.3.6
- Fixed in
- 11.5.17, 12.3.6, 2026.1.2
Which of your client projects are still on pimcore/pimcore 2026.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact pimcore/pimcore version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other pimcore/pimcore versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.