Which versions of Pimcore CMS/DXP are affected by CVE-2026-11407?

Pimcore CMS/DXP 12.3.8 contains a Twig template sandbox bypass vulnerability that enables arbitrary SQL execution, sensitive file reads, and potential remote code execution through malicious template…. A patch is available.

How to fix or mitigate CVE-2026-11407?

Within 24 hours: Audit all Pimcore DataObject ClassDefinition Layout\Text components for suspicious or unauthorized Twig templates, particularly those using the pimcore_* function wildcard. Within 7 days: Apply patch available per vendor advisory to Pimcore CMS/DXP and verify remediation in a test environment before production rollout. Within 30 days: Review administrator permissions for template and ClassDefinition modifications; implement template content validation controls; enable audit logging for configuration changes.

Pimcore CMS/DXP CVE-2026-11407

Q: What is the CVSS score of CVE-2026-11407?

CVE-2026-11407 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-06-17 VulnCheck

GHSA-7p36-fq2r-4h7r

PHP RCE Ssti Pimcore Cms Dxp

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Admin-only Twig injection over the network with no user interaction; full read/write/RCE potential on the same Pimcore instance justifies PR:H, AC:L, and C/I/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 20:33 vuln.today

Analysis Generated

Jun 17, 2026 - 20:33 vuln.today

DescriptionCVE.org

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPolicy. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to perform arbitrary file reads, execute arbitrary database queries, and potentially achieve remote code execution via PHP object gadget chains, with the pimcore_* function wildcard further broadening the bypass to all Pimcore Twig functions.

AnalysisAI

Twig sandbox bypass in Pimcore CMS/DXP 12.3.8 lets authenticated administrators escape the template sandbox by abusing empty checkMethodAllowed() and checkPropertyAllowed() implementations, enabling arbitrary method calls on internal PHP objects such as the DAO layer, Doctrine DBAL Connection, and PDO. Exploitation goes through a malicious Twig template injected via the DataObject ClassDefinition Layout\Text component and can lead to arbitrary file reads, arbitrary SQL execution, and potential remote code execution via PHP object gadget chains; the pimcore_* function wildcard broadens the bypass to every Pimcore Twig function. No public exploit identified at time of analysis, but VulnCheck has published an advisory describing the technique.

Technical ContextAI

Pimcore is a PHP-based open-source CMS/DXP that uses Twig as its templating engine and relies on Twig's Sandbox extension to constrain templates rendered from user-controlled sources, including DataObject ClassDefinition fields like Layout\Text. Pimcore subclassed Twig's SecurityPolicy but left checkMethodAllowed() and checkPropertyAllowed() as empty no-op methods, which corresponds to CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). Because no method-call or property-access filtering took place, any PHP object reachable from a Twig context - including \Pimcore\Model\Dao\AbstractDao, Doctrine\DBAL\Connection, PDO, PDOStatement, the Symfony DI ContainerInterface, and Symfony\Component\Process\Process - could be traversed, as confirmed by the upstream fix in commit fffa7f6 (PR #19193) that adds these classes to a BLOCKED_CLASSES list. Additionally, the policy's pimcore_* function wildcard implicitly allow-lists every Pimcore Twig function, expanding the attack surface beyond the explicit allow list. Affected CPE is cpe:2.3:a:pimcore_gmbh:pimcore_cms/dxp:*.

RemediationAI

Patch available per vendor advisory: upgrade Pimcore CMS/DXP to the release containing pimcore/pimcore PR #19193 / commit fffa7f6396329e88610db70a8652529bbc734892, which implements a BLOCKED_CLASSES deny-list (Pimcore AbstractDao, Doctrine DBAL Connection, PDO, PDOStatement, Symfony ContainerInterface, Symfony Process) inside checkMethodAllowed() and checkPropertyAllowed(); a released patched version number is not stated in the input, so confirm the exact tagged release via the VulnCheck advisory (https://www.vulncheck.com/advisories/pimcore-cms-twig-sandbox-bypass-via-securitypolicy-checkmethodallowed) and the GitHub PR. Until the upgrade is applied, tighten access to the Pimcore admin UI and revoke ClassDefinition edit permissions from any role that does not require them - especially the ability to modify Layout\Text components on DataObject classes - since this is the documented injection sink, accepting that content modelers will lose self-service schema changes. As an interim hardening measure, backport the BLOCKED_CLASSES logic from the upstream commit into the custom SecurityPolicy, and consider network-restricting the /admin interface to VPN or trusted IPs to reduce exposure if an admin account is later compromised; note this will also block legitimate remote administration.