Executive Summary

CVE-2026-41249 is a critical Remote Code Execution (RCE) vulnerability in CoreShop's GitHub Actions workflow. The workflow uses the `pull_request_target` trigger but dangerously checks out unverified code from the pull request head and executes a script from this untrusted source. This allows an external attacker to submit a malicious pull request that runs arbitrary code on the GitHub Actions runner.

The vulnerability arises because `pull_request_target` runs in the context of the base repository, granting access to sensitive secrets and permissions. An attacker can exploit this by forking the repository, modifying files to trigger the workflow, replacing scripts with malicious payloads, and submitting a pull request that executes the payload.

This issue is also known as a "Pwn Request" vulnerability and is classified as CWE-94 (Code Injection).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including allowing attackers to execute arbitrary code on the GitHub Actions runner, effectively gaining full control over the runner's environment.

• Attackers can exfiltrate sensitive secrets such as `PIMCORE_SECRET` or `PIMCORE_PRODUCT_KEY`.
• They can modify repository contents if permissions allow.
• Attackers can abuse the runner's resources for malicious purposes.

The vulnerability has a high severity CVSS score of 8.2 due to its network-based attack vector, low complexity, no required privileges, and high impact on confidentiality.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the GitHub Actions workflow files in the CoreShop repository, specifically the `.github/workflows/static.yml` file or other workflow files that use the `pull_request_target` trigger.

Look for workflows that use `pull_request_target` and check if they dangerously check out unverified code from the pull request head reference (`ref: ${{ github.event.pull_request.head.ref }}`) and execute scripts from this untrusted code.

To detect if your repository is vulnerable, you can run commands to search for the usage of `pull_request_target` and the checkout of untrusted pull request code in your workflow files.

• grep -r 'pull_request_target' .github/workflows/
• grep -r 'github.event.pull_request.head.ref' .github/workflows/

If these patterns are found, it indicates the workflow may be vulnerable to this Remote Code Execution issue.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves avoiding the execution of untrusted code in workflows triggered by `pull_request_target`.

Specifically, do not check out and run scripts from the pull request head ref in workflows triggered by `pull_request_target`, as this runs with elevated permissions and access to secrets.

Instead, adopt a separated workflow architecture:

• Use the `pull_request` event to run builds and tests in an unprivileged sandbox environment without access to secrets.
• Upload build artifacts from the `pull_request` workflow.
• Use the `workflow_run` event to trigger a privileged workflow that downloads the artifacts and performs actions requiring secrets.

Currently, no patched versions of CoreShop are available, so applying this workflow change is the recommended immediate step.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to achieve Remote Code Execution on the GitHub Actions runner by submitting malicious pull requests, which can lead to exfiltration of sensitive secrets such as PIMCORE_SECRET or PIMCORE_PRODUCT_KEY.

This exposure of sensitive information and unauthorized code execution can compromise confidentiality and integrity of data, potentially violating compliance requirements under standards like GDPR and HIPAA that mandate protection of sensitive data and secure processing environments.

Because the vulnerability enables attackers to access secrets and possibly modify repository contents or abuse runner resources, it poses a significant risk to maintaining compliance with regulations that require strict access controls and data protection.

Useful 0 Not Useful 0