Coreshop
CVE-2026-22242
MEDIUM
GHSA-ch7p-mpv4-4vg4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries in ORM
|
| Impact | CVSS 4.9 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: None. Exploitation requires administrator-level access. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker (requires administrator-level access) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Blind SQL injection in CoreShop prior to version 4.1.8 allows authenticated administrators to extract sensitive database information through boolean-based or time-based attack techniques. The vulnerability is limited to information disclosure due to the application's read-only database permissions, preventing data modification or denial of service. Public exploit code exists for this vulnerability; administrators should upgrade to version 4.1.8 or later.
Earlier versions of this analysis (1)
CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. [CVSS 4.9 MEDIUM]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 4.1.8.. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-564 (SQL Injection: Hibernate). Affects Coreshop. CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.
Know when Coreshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.
Executive ViewAI
Organizations using CoreShop should be aware of moderate risk from CVE-2026-22242 rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Unauthenticated SQL injection in CoreShop by CoreUnion through 1.5.5 lets remote attackers read member accounts and orde
Unauthenticated SQL injection in CoreShop through 1.5.5 allows remote attackers to read member accounts and order record
Any authenticated CoreShop customer can tamper with other customers' orders in versions through 1.5.5, because the Order
Missing authorization in CoreShop through 2026.2.2 lets authenticated Pimcore backend users who lack the relevant resour
Improper input sanitization in CoreShop's CustomerTransformerController prior to version 4.1.9 allows authenticated admi
Exploit-DB