CVE-2026-45162
Received Received - Intake

Unsafe Unserialize in Pimcore Data Management Platform

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-18
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-45162
EUVD
EUVD-2026-45259

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
pimcore pimcore to 11.5.17 (inc)
pimcore pimcore to 12.3.7 (inc)
pimcore pimcore to 11.5.16 (exc)
pimcore pimcore 11.5.17
pimcore pimcore 12.3.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45162 is an unsafe PHP deserialization vulnerability in Pimcore. Multiple locations in Pimcore call PHP's unserialize() function without restricting allowed classes. This allows attackers who control serialized data to inject malicious objects, potentially leading to remote code execution.

Detection Guidance

To detect this vulnerability, check if your Pimcore version is below 11.5.17 (LTS) or 12.3.7. Inspect code for unsafe unserialize() calls without allowed_classes restrictions in files like lib/Tool/Authentication.php, models/Site/Dao.php, and others. Use grep commands to search for unserialize() usage in your codebase.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on your system. An attacker would need to control the serialized data source, such as via SQL injection or file write, to inject a malicious PHP gadget chain that executes during deserialization.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially compromising sensitive data. Such breaches may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data processed by Pimcore.

Mitigation Strategies

Immediately upgrade Pimcore to version 11.5.17 (LTS) or 12.3.7 or later. If upgrading is not possible, modify all unserialize() calls to include the allowed_classes parameter to restrict deserialization to trusted classes. Replace unsafe unserialize() with JSON serialization where possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart