GHSA-7gxw-q9j5-mrj4

Pimcore has an authenticated Cross-site Scripting issue

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-5362

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	pimcore/pimcore	12.3.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-5362 advisory
https://fluidattacks.com/es/advisories/mago web
https://github.com/pimcore/pimcore package