CVE-2026-109392 in Pimcore
Summary
by MITRE • 10/12/2026
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the admin origin when other users open version preview or diff views.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw resides within Pimcore, a digital experience management platform, specifically affecting versions up to 2026.3.1. This vulnerability is classified as a stored cross-site scripting (XSS) issue that stems from the improper handling of user-supplied input in ExternalImage fields. Unlike reflected XSS attacks where malicious scripts are executed immediately via a crafted link, this flaw involves persisting the malicious payload within the application's database or storage mechanism. The root cause lies in the failure to properly sanitize and escape URL data when it is stored in these specific image attributes. Consequently, when the system later renders this data for display purposes without applying appropriate output encoding, the embedded script code is interpreted by the victim's web browser as executable JavaScript rather than plain text.
The operational impact of this vulnerability is significant because it requires authentication and specific permissions to exploit effectively. An attacker must possess edit permissions on data objects within the Pimcore backend interface. Once authenticated with these privileges, the adversary can inject malicious scripts into ExternalImage fields by manipulating URL values during object creation or modification. The payload remains dormant in the system until another user interacts with the compromised content. Specifically, when an administrator or other authorized personnel opens a version preview or diff view of the affected data object, their browser executes the stored script within the context of the Pimcore admin origin. This session-based execution allows the attacker to perform actions on behalf of the victim, such as stealing administrative cookies, capturing sensitive input data, or performing state-changing requests that the authenticated user is authorized to make.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored persistence, distinguishing it from other XSS variants by its reliance on database storage and subsequent retrieval for rendering. In terms of the MITRE ATT&CK framework, this attack vector maps to T1059, Command and Scripting Interpreter, specifically through browser-based execution via HTML/JavaScript. It also relates to T1273, Data from Information Repositories, as the attacker leverages stored data objects to deliver the malicious payload. The ability to execute scripts in the admin origin further elevates the risk profile, potentially leading to full account compromise and unauthorized access to sensitive enterprise content management systems.
Mitigation strategies should focus on both immediate remediation and long-term defensive coding practices. For organizations running affected versions of Pimcore, applying the latest security patch that addresses version 2026.3.1 is the primary recommendation. This update likely includes fixes for input validation and output encoding in ExternalImage handling logic. In environments where patching cannot be immediately implemented, administrators should enforce strict role-based access control to limit who can edit data objects containing external image fields. Additionally, implementing a Content Security Policy (CSP) header that restricts script execution origins can help mitigate the impact by preventing the loaded scripts from accessing sensitive cookies or performing unauthorized actions in the admin context. Developers integrating Pimcore should also ensure that any custom modules adhere to strict input sanitization and output encoding standards consistent with OWASP guidelines for XSS prevention, particularly when handling dynamic URL data within image attributes.