Pimcore CVE-2026-109392

Exploitation requires an authenticated Pimcore backend account that holds data object edit permission (PR:L), which the attacker uses to write an attribute-breaking payload into an ExternalImage class-definition field where the stored URL is rendered unescaped. The payload is dormant until a second user opens the affected object's version preview or version diff view (the UI:P/passive-interaction requirement), meaning no self-triggering and no fully unauthenticated path exists. Limiting factors: the attacker needs edit rights on data objects using an ExternalImage field, the victim must independently navigate to the preview/diff view, and impact is confined to the admin backend origin - there is no anonymous, default-configuration remote exploitation.

This is a stored XSS (CWE-79) in Pimcore through 2026.3.1 that warrants moderate, not urgent, prioritization. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) and its 5.1 score point to a network-reachable but privilege- and interaction-gated flaw: the attacker must already be an authenticated backend user holding data object edit permission (PR:L), and a second victim user must passively open a version preview or diff view (UI:P) for the payload to fire. Publicly available exploit code exists (write-up on hackmd.io plus a VulnCheck advisory), which raises practical likelihood and lowers the skill barrier, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - treat the POC as proof of feasibility, not of in-the-wild use. The impact is genuine but bounded: execution occurs in the admin origin, enabling session-context actions against other operators, yet all impact sub-metrics are rated Low. The main contrast in signals is high exploit maturity (public POC) against low prerequisites-adjusted reach (requires an authenticated insider or compromised low-priv account plus victim interaction), making this primarily an insider/privilege-escalation-within-backend concern rather than an internet-facing mass-exploitation risk. No key data is internally conflicting; the chief gap is the absence of EPSS/KEV telemetry to gauge real-world activity.

A low-privileged Pimcore backend user with data object edit permission enters an attribute-breaking payload into an ExternalImage field's URL so that the stored, unescaped value injects script markup. When a higher-privileged administrator later opens that object's version preview or diff view, the JavaScript executes in the admin origin, letting the attacker act in the victim's authenticated backend session. Publicly available exploit code (hackmd.io write-up and VulnCheck advisory) demonstrates the attribute-breaking technique, and the network attack vector with low complexity makes it reliably reproducible once the attacker has edit rights.