GHSA-q433-j342-rp9h CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- Severity
- 8.6 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.43%
- Chance of exploitation in the next 30 days. Higher than 36.97% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-532 Insertion of Sensitive Information into Log File
- Fix
12.3.1- Upgrade pimcore/pimcore to this version or later
Description
Summary
The http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend.
Details
It’s better to remove both lines, as this information makes little sense in this context anyway.
https://github.com/pimcore/pimcore/blob/12.x/bundles/SeoBundle/src/EventListener/ResponseExceptionListener.php#L92 https://github.com/pimcore/pimcore/blob/12.x/bundles/SeoBundle/src/EventListener/ResponseExceptionListener.php#L93
PoC
In the Pimcore backend, navigate to "Search Engine Optimization" and click on "HTTP Errors." Double-click on an entry to view its details. Here, you may find sensitive data exposed.
Impact
Pimcore backend users can access sensitive environment variables, potentially exposing critical information.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| pimcore/pimcore | >= 12.0.0-RC1, < 12.3.1 |
12.3.1 |
| pimcore/pimcore | < 11.5.14 |
11.5.14 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pimcore/pimcore Packagist → 12.3.1
- composer
composer require pimcore/pimcore:^12.3.1
Severity breakdown
CVSS 3.1 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Weakness
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it
- Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-23rh-xw42-fq82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration | High | Also affects pimcore/pimcore |
| GHSA-9x44-4gxf-8c25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name | Critical | Also affects pimcore/pimcore |
| GHSA-w23p-wrp7-ch38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) | Critical | Also affects pimcore/pimcore |
| GHSA-2mhj-fhvg-v428 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | High | Also affects pimcore/pimcore |
| GHSA-7p36-fq2r-4h7r Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | High | Also affects pimcore/pimcore |
| GHSA-jwcc-gv4m-93x6 Pimcore has a CustomReports Share Bypass | High | Also affects pimcore/pimcore |
| GHSA-332x-r494-54fq Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | Medium | Also affects pimcore/pimcore |
| GHSA-wc7j-g8wx-m2qx Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | High | Also affects pimcore/pimcore |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor