HighGHSA-q433-j342-rp9hCVE-2026-23493

Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

Published 15 Jan 2026 · Updated 3 Feb 2026

Affected packages

pimcore/pimcoreComposer
Affected
>=12.0.0-RC1 <12.3.1
Fixed in
12.3.1
Update to the fixed version for your release line, for example:composer require pimcore/pimcore:^12.3.1
pimcore/pimcoreComposer
Affected
<11.5.14
Fixed in
11.5.14
Update to the fixed version for your release line, for example:composer require pimcore/pimcore:^11.5.14

Details

Summary

The http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend.

Details

It’s better to remove both lines, as this information makes little sense in this context anyway.

https://github.com/pimcore/pimcore/blob/12.x/bundles/SeoBundle/src/EventListener/ResponseExceptionListener.php#L92 https://github.com/pimcore/pimcore/blob/12.x/bundles/SeoBundle/src/EventListener/ResponseExceptionListener.php#L93

PoC

In the Pimcore backend, navigate to "Search Engine Optimization" and click on "HTTP Errors." Double-click on an entry to view its details. Here, you may find sensitive data exposed.

Impact

Pimcore backend users can access sensitive environment variables, potentially exposing critical information.

Is GHSA-q433-j342-rp9h in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.