PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-109392 Pimcore CVE debrief

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the admin origin when other users open version preview or diff views.

Vendor
Pimcore
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Pimcore installations, particularly those with users having data object edit permissions, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and remediate this vulnerability to prevent potential JavaScript execution in the admin origin.

Why it matters

Defenders should care about CVE-2026-109392 because it allows authenticated users to inject scripts, potentially leading to JavaScript execution in the admin origin, and requires verification and remediation in Pimcore installations.

  • Potential JavaScript execution in the admin origin
  • Data object edit permission exploitation
  • Version preview and diff view exposure

Technical summary

The vulnerability allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields, which can execute JavaScript in the admin origin when other users open version preview or diff views. This stored cross-site scripting vulnerability affects Pimcore through version 2026.3.1 and requires verification and remediation in Pimcore installations, particularly for users with data object edit permissions. The vulnerability has a CVSS score of 5.1 and is considered medium severity. Defenders should prioritize verifying and remediating this vulnerability.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Pimcore installations, particularly for users with data object edit permissions.

Recommended defensive actions

  • Verify Pimcore version and ensure it is not vulnerable
  • Restrict data object edit permissions to trusted users
  • Monitor for suspicious activity in version preview and diff views
  • Implement additional security measures to prevent XSS attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify Pimcore installations, particularly those with users having data object edit permissions, and assess exposure to this stored cross-site scripting vulnerability. Evidence is limited to CVE and source-item descriptions; further verification is required to confirm affected scope and severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-109392 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-109392

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-109392 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109392

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109392.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJCbgCKjMe

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pimcore/pimcore/blob/v2026.3.1/models/DataObject/ClassDefinition/Data/ExternalImage.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pimcore/admin-ui-classic-bundle/blob/2.3/templates/admin/data_object/data_object/preview_version.html.twig

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pimcore/pimcore

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/pimcore-through-2026.3.1-stored-xss-via-externalimage-field-version-preview

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.