Pimcore CVE-2026-5362

Exploitation requires two specific, concurrent conditions: first, the attacker must possess an authenticated Pimcore account with at least editor-level permissions that grant the ability to modify Document content and access the embed editable component (reflected in PR:L of the CVSS 4.0 vector); second, a victim must actively load the published page containing the injected payload in their browser (UI:A). The vulnerable surface is specifically the Document embed editable - Pimcore installations that disable this content block type, restrict its use to a small set of fully trusted administrators, or have no published pages using it are not exposed. Exploitation is classified as non-automatable by SSVC, meaning each successful compromise requires a real human victim rendering the page. Unauthenticated external attackers cannot inject payloads. The attack does not affect the Pimcore server itself, only the browsers of users who view the poisoned page.

The CVSS 4.0 score of 4.8 (Medium) accurately captures the combined effect of the authentication barrier (PR:L) and mandatory victim interaction (UI:A), both of which meaningfully reduce exploitability relative to an unauthenticated, interaction-free flaw. The vector reports no impact on the vulnerable system itself (VC:N/VI:N/VA:N) - impact is confined to subsequent systems, specifically victim browsers (SC:L/SI:L), consistent with stored XSS semantics. EPSS at 0.00% (0th percentile) corroborates minimal observed exploitation interest across the broader threat landscape. SSVC signals reinforce a deprioritized posture: Exploitation=none, Automatable=no, Technical Impact=partial. The non-automatable classification is significant - each exploitation instance requires a specific human victim to render the page, preventing mass automated campaigns. Real-world risk is most acute in multi-tenant or public-facing Pimcore deployments where semi-trusted editors may have access to Document embed editables and can target privileged administrators. In tightly controlled deployments with a small, fully trusted editorial team, practical risk is low. No conflicts between available data signals were identified.

An attacker holding a low-privilege Pimcore editor account injects a JavaScript payload - for example, a script that exfiltrates the victim's session cookie to an attacker-controlled endpoint - into a Document embed editable field within a CMS page, then publishes it. Any user, including an administrator, who subsequently visits the published page in their browser silently executes the injected script, potentially surrendering their session or credentials. No public exploit code has been identified at time of analysis.