PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41249 coreshop CVE debrief

CVE-2026-41249 is a high-severity vulnerability in CoreShop, a Pimcore enhanced eCommerce solution. The vulnerability allows for Remote Code Execution (RCE) via a malicious Pull Request. CoreShop versions 5.0.1 through 5.1.0-beta.1 are affected. The GitHub Actions workflow (.github/workflows/static.yml) uses the pull_request_target trigger but dangerously checks out the unverified code from the pull request head (ref: ${{ github.event.pull_request.head.ref }}). Subsequently, it executes a script (bin/console) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request.

Vendor
coreshop
Product
Unknown
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Users of CoreShop versions 5.0.1 through 5.1.0-beta.1, administrators of GitHub Actions workflows, and security teams monitoring for RCE vulnerabilities in eCommerce solutions.

Technical summary

The vulnerability is caused by the use of the pull_request_target trigger in the GitHub Actions workflow (.github/workflows/static.yml) which checks out unverified code from the pull request head and executes a script (bin/console) from this untrusted checkout. This allows an external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner by submitting a malicious Pull Request.

Defensive priority

High

Recommended defensive actions

  • Update CoreShop to a version that fixes the vulnerability.
  • Review and modify the GitHub Actions workflow (.github/workflows/static.yml) to safely handle pull requests.
  • Implement additional security measures to monitor and restrict execution of scripts from untrusted sources.

Evidence notes

CVE-2026-41249 has a CVSS score of 8.2 and is classified as HIGH severity. The vulnerability is exploitable remotely with low attack complexity and requires no user interaction.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41249 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41249

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41249 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41249

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.