CVE-2026-23493

Published: Jan 15, 2026Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.

Affected (2)

Products: Pimcore: Pimcore

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Pimcore Pimcore	Before 11.5.14
Pimcore Pimcore	From 12.0.0 to 12.3.1

Related CWEs

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (6)

https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601

Source: security-advisories@github.com

Patch

https://github.com/pimcore/pimcore/pull/18918

Source: security-advisories@github.com

Issue Tracking

https://github.com/pimcore/pimcore/releases/tag/v11.5.14

Source: security-advisories@github.com

Release Notes

https://github.com/pimcore/pimcore/releases/tag/v12.3.1

Source: security-advisories@github.com

Release Notes

https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h

Source: security-advisories@github.com

Vendor Advisory

https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vendor Advisory

Timeline

No history available yet.