Pimcore CVE-2026-5362

Q: What is the CVSS score of CVE-2026-5362?

CVE-2026-5362 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25917 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-27 Fluid Attacks

XSS Pimcore

4.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable stored XSS requires low-privilege editor authentication (PR:L) and victim page load (UI:R), with scope change to victim browsers (S:C); no server-side confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:59 vuln.today

CVSS changed

Apr 27, 2026 - 21:22 NVD

4.8 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 20:30 euvd

EUVD-2026-25917

CVE Published

Apr 27, 2026 - 20:16 nvd

MEDIUM 4.8

DescriptionCVE.org

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered.

This issue affects pimcore: v12.3.3.

AnalysisAI

Stored cross-site scripting in Pimcore v12.3.3 allows authenticated editors to persistently inject malicious HTML/JavaScript into the Document embed editable component, with the payload executing in victim browsers whenever the published page is rendered. Exploitation requires a low-privilege authenticated account and active user interaction from a victim, materially limiting the attack surface relative to a fully unauthenticated XSS. No public exploit has been identified at time of analysis and EPSS sits at 0.00% (0th percentile), indicating negligible observed exploitation activity.

Technical ContextAI

Pimcore is an open-source PHP-based content management and product information management (PIM) platform. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) and resides specifically in the Document embed editable, a rich-content block that permits editors to embed arbitrary HTML within CMS pages. Pimcore fails to sanitize or output-encode user-supplied content stored in this editable before rendering it to page visitors, producing a persistent (stored) XSS condition. The affected product is identified by CPE cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*, with confirmed affected version v12.3.3 per both the CVE description and ENISA EUVD-2026-25917. Unlike reflected XSS, the injected payload is persisted in the database and fires on every subsequent page load by any visitor of the published page.

RemediationAI

No vendor-released patched version is confirmed from the available references - the GitHub link (https://github.com/pimcore/pimcore/) points to the upstream repository without citing a specific tagged release containing a fix. Administrators should monitor the Pimcore GitHub repository and the Fluid Attacks advisory (https://fluidattacks.com/es/advisories/mago) for patch release announcements and apply them promptly once available. As an immediate compensating control, restrict access to the Document embed editable to fully trusted editorial staff only - this is the specific feature class through which exploitation occurs, and limiting it eliminates the attack surface without disabling other Pimcore functionality. Additionally, enforce a Content Security Policy (CSP) response header on published pages that disables inline script execution (script-src 'self'); note this may break legitimate inline JavaScript in existing page templates and should be tested in staging before production deployment. Conduct a retrospective audit of existing Document embed editable content for suspicious script tags as a detection measure.