CVE-2026-55220

Received Received - Intake

PHP Object Injection in Pimcore DataObject

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource() in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field __hotspots object-store column to Pimcore\Tool\Serialize::unserialize() without an allowed-classes restriction after JSON decoding fails. An attacker with a separate capability to write crafted PHP serialized bytes into that column can instantiate available classes and trigger magic methods when an affected DataObject is loaded, which can produce arbitrary file writes or code execution through bundled gadget chains. The related ImageGallery, Block, and Video callers use the same fallback pattern, but the identified June fix changes the Hotspotimage caller only. This issue is fixed for Hotspotimage in versions 11.5.19, 12.3.10, and 2026.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55220

EUVD

EUVD-2026-67870

Affected Vendors & Products

Vendor	Product	Version / Range
pimcore	pimcore	to 11.5.19 (inc)
pimcore	pimcore	to 12.3.10 (inc)
pimcore	pimcore	to 2026.1.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-55220 is a PHP Object Injection vulnerability in Pimcore, a content management platform. It occurs in the Hotspotimage class where serialized data from the __hotspots column is deserialized without proper class restrictions. Attackers with write access to this column can inject malicious serialized payloads, triggering PHP Object Injection (CWE-502). This can lead to remote code execution via gadget chains in dependencies like guzzlehttp/guzzle.

Impact Analysis

An attacker could exploit this to write arbitrary files or execute code on your system by leveraging gadget chains in Pimcore's dependencies. The vulnerability is triggered when an object with a Hotspotimage field is loaded, affecting admin UI, frontend rendering, and API reads. Exploitation requires the attacker to have write access to the __hotspots column.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data access, violating confidentiality and integrity requirements in GDPR and HIPAA. A successful exploit may result in data breaches, unauthorized modifications, or system compromise, all of which are non-compliant with these regulations.

Mitigation Strategies

Upgrade Pimcore to version 11.5.19, 12.3.10, or 2026.1.6 or later to address the deserialization vulnerability in Hotspotimage and related fields.

Review and restrict write access to the __hotspots object-store column to prevent unauthorized data injection.
Monitor for unusual file writes or code execution attempts, especially in contexts where Hotspotimage, ImageGallery, Block, or Video fields are loaded.

Hi! I’m here to help you understand CVE-2026-55220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70